Installing and configuring Advanced Policy Firewall

Installing and Configuring Advanced Policy Firewall (APF)

Learn how to install and configure the Advanced Policy Firewall (APF), which allows you to grant or deny access to selected IP addresses and services running on your server.

Note

Root access to the server is required to perform these procedures.

About Advanced Policy Firewall (APF)

APF is designed for unmanaged VPS servers to help secure your system. It allows you to:

• Explicitly grant or deny access to selected IP addresses
• Control access to specific services running on the server
• Protect against brute-force login attempts

Installing Advanced Policy Firewall

1. Log in to your server via SSH.
2. Download APF to your server:

wget http://www.rfxn.com/downloads/apf-current.tar.gz

3. Extract the files:

tar xvzf apf-current.tar.gz

4. Enter the extracted directory (version number may vary):

cd apf-9.7-2

5. Run the installation script:

./install.sh

Note

You may see the error:
eth0: error fetching interface information: Device not found
This can be safely ignored.

Configuring Advanced Policy Firewall

Basic Configuration

1. Open the configuration file:

nano /etc/apf/conf.apf

2. Locate the following settings:

IFACE_IN="eth0"
IFACE_OUT="eth0"
SET_MONOKERN="0"
HELPER_SSH_PORT="22"
IG_TCP_CPORTS="22"

3. Modify them as follows (adjust to your server settings):

IFACE_IN="venet0"
IFACE_OUT="venet0"
SET_MONOKERN="1"
HELPER_SSH_PORT="7822"
IG_TCP_CPORTS="80,7822,8000"

You can add other ports to IG_TCP_CPORTS as needed.
List of TCP/UDP ports

4. Save changes and start APF in development mode:

apf --start

Development mode automatically drops all firewall rules after 5 minutes to prevent accidental lockouts.

5. Test your allowed connections (SSH, HTTP, etc.) before disabling development mode.
6. Disable development mode by editing the line:

DEVEL_MODE="0"

7. Save and restart the system. APF is now active.

Granting Access

APF uses a whitelist (/etc/apf/allow_hosts.rules) and a blacklist (/etc/apf/deny_hosts.rules) to regulate traffic.

Add your IP to the whitelist

# Comment describing the rule
tcp:in:d=7822:s=xxx.xxx.xxx.xxx

Replace xxx.xxx.xxx.xxx with your IP address. Add a comment for clarity.
Find your IP

• Add multiple IPs on separate lines.
• Restart APF to apply changes:

apf --restart

Denying Access

Block a specific IP

apf --deny xxx.xxx.xxx.xxx comment

Replace xxx.xxx.xxx.xxx with the IP you want to block. Add an optional comment.

• To block an entire network, use CIDR notation:

192.168.100.0/24

• To unblock an IP, remove or comment out the line in /etc/apf/deny_hosts.rules and restart APF:

apf --restart

More Information

For full APF documentation, visit: Advanced Policy Firewall