# Installing and configuring Advanced Policy Firewall

> Install Advanced Policy Firewall (APF) on an unmanaged server and use it to allow or deny IP addresses and services.

Source: https://helpcenter.ruachost.com/developers/linux/installing-and-configuring-advanced-policy-firewall/

## **Installing and Configuring Advanced Policy Firewall (APF)**

Learn how to install and configure the **Advanced Policy Firewall (APF)**, which allows you to grant or deny access to selected IP addresses and services running on your server.

>

> **Note:**
Root access to the server is required to perform these procedures.

#### **About Advanced Policy Firewall (APF)**

APF is designed for **unmanaged VPS servers** to help secure your system. It allows you to:

- Explicitly grant or deny access to selected IP addresses
- Control access to specific services running on the server
- Protect against brute-force login attempts

#### **Installing Advanced Policy Firewall**

1. Log in to your server via SSH.
2. Download APF to your server:

```
wget http://www.rfxn.com/downloads/apf-current.tar.gz
```

3. Extract the files:

```
tar xvzf apf-current.tar.gz
```

4. Enter the extracted directory (version number may vary):

```
cd apf-9.7-2
```

5. Run the installation script:

```
./install.sh
```

>

> **Note:**
You may see the error:\
`eth0: error fetching interface information: Device not found`\
This can be safely ignored.

#### **Configuring Advanced Policy Firewall**

##### **Basic Configuration**

1. Open the configuration file:

```
nano /etc/apf/conf.apf
```

2. Locate the following settings:

```
IFACE_IN="eth0"
IFACE_OUT="eth0"
SET_MONOKERN="0"
HELPER_SSH_PORT="22"
IG_TCP_CPORTS="22"
```

3. Modify them as follows (adjust to your server settings):

```
IFACE_IN="venet0"
IFACE_OUT="venet0"
SET_MONOKERN="1"
HELPER_SSH_PORT="7822"
IG_TCP_CPORTS="80,7822,8000"
```

> You can add other ports to `IG_TCP_CPORTS` as needed.\
> [List of TCP/UDP ports](http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers)

4. Save changes and start APF in **development mode**:

```
apf --start
```

> Development mode automatically drops all firewall rules after 5 minutes to prevent accidental lockouts.

5. Test your allowed connections (SSH, HTTP, etc.) before disabling development mode.
6. Disable development mode by editing the line:

```
DEVEL_MODE="0"
```

7. Save and restart the system. APF is now active.

#### **Granting Access**

APF uses a **whitelist** (`/etc/apf/allow_hosts.rules`) and a **blacklist** (`/etc/apf/deny_hosts.rules`) to regulate traffic.

##### **Add your IP to the whitelist**

```
# Comment describing the rule
tcp:in:d=7822:s=xxx.xxx.xxx.xxx
```

> Replace `xxx.xxx.xxx.xxx` with your IP address. Add a comment for clarity.\
> [Find your IP](http://ipfinder.us/)

- Add multiple IPs on separate lines.
- Restart APF to apply changes:

```
apf --restart
```

#### **Denying Access**

##### **Block a specific IP**

```
apf --deny xxx.xxx.xxx.xxx comment
```

> Replace `xxx.xxx.xxx.xxx` with the IP you want to block. Add an optional comment.

- To block an entire network, use CIDR notation:

```
192.168.100.0/24
```

- To unblock an IP, remove or comment out the line in `/etc/apf/deny_hosts.rules` and restart APF:

```
apf --restart
```

#### **More Information**

For full APF documentation, visit: [Advanced Policy Firewall](http://www.rfxn.com/projects/advanced-policy-firewall)