There’s a lot of crap out there on the Internets. So having a firewall is a must if you’re running a virtual or dedicated server. This is a quick guide on how to install APF on your linux server.

First, download the latest and greatest version of APF from R-FX Networks:

http://www.rfxn.com/downloads/apf-current.tar.gz


cd /tmp
wget http://www.rfxn.com/downloads/apf-current.tar.gz
tar -zxf apf-current.tar.gz
cd apf-0.*
./install.sh

*Notice: apply the latest version number here.

This should automatically install APF on your server. Now we have to edit the configuration file.

nano -w /etc/apf/conf.apf

Scroll down to the “Inbound (Ingress) TCP/UDP Ports” and “Outbound (Egress) TCP/UDP Port” section. Please find the correct configuration for your control panel.

—–cPanel—–
IG_TCP_CPORTS=”20,21,22,25,26,53,80,110,143,443,465,993,995,2082,2083,2086,2087,2095,2096″
IG_UDP_CPORTS=”21,53,873″

EGF=”1″
EG_TCP_CPORTS=”21,22,25,26,27,37,43,53,80,110,113,443,465,873,2089″
EG_UDP_CPORTS=”20,21,37,53,873″

—-Ensim—–
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,19638″
IG_UDP_CPORTS=”53″

EGF=”1″
EG_TCP_CPORTS=”21,22,25,53,80,110,443″
EG_UDP_CPORTS=”20,21,53″

—-Plesk—–
IG_TCP_CPORTS=”20,21,22,25,53,80,110,143,443,465,993,995,8443″
IG_UDP_CPORTS=”37,53,873″

EGF=”1″
EG_TCP_CPORTS=”20,21,22,25,53,37,43,80,113,443,465,873,5224″
EG_UDP_CPORTS=”53,873″

Save the file and start APF.

apf -s

If everything still works then edit the config file and turn DEVEL_MODE OFF. Make absolutely sure you can start a new SSH session before changing DEVEL_MODE OFF.

***AGAIN, please make sure you are able to start a new SSH session. This is your last warning!!!

DEVEL_MODE=”0″

Now, restart APF and everything should be working!!!

apf -r

If you have an issues or need a list of available of commands for APF:

apf --help

Also, if you are getting an error on startup or restart similar to this:

unable to load iptables module (ip_tables), aborting. apf

try changing SET_MONOKERN=”0″ to “1″ – although it is not recommended, this allows for APF to run if this module is not directly compiled into the kernel.