Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Hosting Security and Technology Tutorials : APF FireWall Installation [Easy]

[Cirtex]

Hi,

This is a pretty simple How-to for installing APF Firewall.

1) Install:
wget http://www.rfxnetworks.com/downloads/apf-current.rpm
rpm -Uvh apf-current.rpm

2) Edit:
/etc/apf/conf.apf

DEVM="0" - set to 0 only if you are sure that firewall works good

(Common Cpanel Ports, please re-configure for your use)
TCP_CPORTS=" 21,22,25,53,80,110,143,443,465,993,995,2082,2083,2086,2087,2095,2096,3306,7786" (in one line!)

UDP_CPORTS="37,53,873"

Many other options in which you can enable inside the config. Please take time to configure.

3) Restart APF


To Enable Pings:

pico -w /etc/apf/icmp.rules
Uncomment:

# Uncomment to enable pings
# $IPT -t filter -A INPUT -p icmp --icmp-type 8 -m limit --limit $ICMP_LIM/s -j ACCEPT
Then restart APF

------------------------------
commands:
/etc/rc.d/init.d/apf stop
/etc/rc.d/init.d/apf start
/etc/rc.d/init.d/apf restart

Thanks to EV1 Forum for much info on this.

[Akash]

Thanks for the How-To!

Hopefully someone can follow this up with a detailed tutorial on how to configure APF

<edit>signature removed</edit>

[Haze]

3 things,

1. I believe Ryan ( APF Author ) has recommended against the rpm.. and it may be outdated.

2. Why reboot?

3. This how-to seems to be fairly outdated, compared to the most recent APF versions.

Edit: I should also note for future readers that the above seems to be targeted towards cpanel / whm systems.

<edit>signature removed</edit>

[Cirtex]

Originally posted by Haze
3 things,

1. I believe Ryan ( APF Author ) has recommended against the rpm.. and it may be outdated.

2. Why reboot?

3. This how-to seems to be fairly outdated, compared to the most recent APF versions.

Edit: I should also note for future readers that the above seems to be targeted towards cpanel / whm systems.

Sorry, I meant by restart apf, not reboot..
It be great if you can contribute a How-To for APF. (No RPM)
Also, these arent targeted towards only cpanel systems.

Cheers.

<edit>signature removed</edit>

[kris1351]

The documentation for APF is very clear and it is a very simple install. Basically untar it and run ./install.sh. The version outlined above is an old one as the port defining sections have changed in 0.9.3. In Ryan's forums there are sections of what he leaves open for different panels.

<edit>signature removed</edit>

[Cirtex]

Hi,

Ok anyways, here's installing without using RPM, this is a newer version of APF.

wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

tar -xzf apf-current.tar.gz

cd /apf-0.9.3_3
./install.sh

Your set
Remember to edit config etc..and read the README.

<edit>signature removed</edit>

[rfxn]

http://www.webhostgear.com/61.html

<edit>signature removed</edit>

[Cirtex]

Originally posted by rfxn
http://www.webhostgear.com/61.html

Yea just saw that one posted on burst's forum, pretty good how-to as well

<edit>signature removed</edit>

[mikeym]

lsmod: QM_MODULES: Function not implemented

Unable to load iptables module (ip_tables), aborting.

Any ideas?

<edit>signature removed</edit>

[mikeym]

Nevermind, I got it running.

<edit>signature removed</edit>

[blackmoont]

and how to remove APF ? I'v install a rpm (old one ) and how to remove it to install a new one ?

[Cirtex]

Try rpm -e apf

<edit>signature removed</edit>

[SynHost]

Originally posted by 93.3
lsmod: QM_MODULES: Function not implemented

Unable to load iptables module (ip_tables), aborting.

Any ideas?

<edit>signature removed</edit>

If your kernel is compiled with iptables statically instead of as a module you need to do this in the conf.apf MONOKERN="0" Set it to "1" and then try start APF again.

[Cirtex]

Originally posted by SynHost
If your kernel is compiled with iptables statically instead of as a module you need to do this in the conf.apf MONOKERN="0" Set it to "1" and then try start APF again.

Yep, that should take care of it. Older version though don't have this option.

[lexis2004]

I am only getting the following error: lsmod: QM_MODULES: Function not implemented wil making the same change to the config file work as well?

Thanks, Kevin