工具不是很适合我，给大家作个参考
什么是APF？
APF(Advanced Policy Firewall)是 Rf-x Networks 出品的Linux环境下的软件防火墙,被大部分Linux服务器管理员所采用,使用iptables的规则,易于理解及使用.可算是Linux使用较多的防火墙.APF的配置参数众多,有效利用这些配置参数可加强你的服务器安全,APF应该在每一台Linux服务器中得到应用.
安装APF
1.下载最新的安装包并解压缩,APF项目详细信息.
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 4 |
#cd /usr/local/src #wget <a href="http://www.rfxn.com/downloads/apf-current.tar.gz">http://www.rfxn.com/downloads/apf-current.tar.gz</a> #tar -zxf apf-current.tar.gz #cd apf-9.7-1/ |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
2.执行安装
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
#sh ./install.sh |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
结束安装好你会得到一些信息:
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 4 5 6 |
... Installation Details: Install path: /etc/apf/ Config path: /etc/apf/conf.apf Executable path: /usr/local/sbin/apf ... |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
3.进行详细配置
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
#vi /etc/apf/conf.apf |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
默认的参数适合大多数场合,按照需要进行修改即可
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 4 5 6 7 8 |
DEVEL_MODE="1" >> DEVEL_MODE="0" RAB="0" >> RAB="1" RAB_PSCAN_LEVEL="2" >> RAB_PSCAN_LEVEL="3" TCR_PASS="1" >> TCR_PASS="0" DLIST_PHP="0" >> DLIST_PHP="1" DLIST_SPAMHAUS="0" >> DLIST_SPAMHAUS="1" DLIST_DSHIELD="0" >> DLIST_DSHIELD="1" DLIST_RESERVED="0" >> DLIST_RESERVED="1" |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
流入端口过滤
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 4 |
# Common ingress (inbound) TCP ports IG_TCP_CPORTS="20,21,22,25,26,53,80,110,143,443,465,993,995,3306" # Common ingress (inbound) UDP ports IG_UDP_CPORTS="21,53,465" |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
流出端口过滤,虚拟主机推荐开启
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 4 5 6 |
# Outbound (egress) filtering EGF="1" # Common outbound (egress) TCP ports EG_TCP_CPORTS="21,22,25,26,37,43,53,80,110,113,443,465,3306" # Common outbound (egress) UDP ports EG_UDP_CPORTS="20,21,53,465" |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
ICMP过滤
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 |
# Common ICMP outbound (egress) types # 'internals/icmp.types' for type definition; 'all' is wildcard for any EG_ICMP_TYPES="all" |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
另外还有两个值得注意的设置文件: /etc/apf/allow_hosts.rules 和 /etc/apf/deny_hosts.rules 可设置目标主机的过滤规则.如添加信任主机操作等.
启动APF
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
#/usr/local/sbin/apf -s |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
重启APF
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
#/usr/local/sbin/apf -r |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
查看运行日志
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
#tail -f /var/log/apf_log |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
添加为系统启动
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
#vi /etc/rc.local |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
在其中添加 "/usr/local/sbin/apf -s" 即可(不含双引号).
详细参数说明
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
usage /usr/local/sbin/apf [OPTION] -s|--start ......................... load all firewall rules -r|--restart ....................... stop (flush) & reload firewall rules -f|--stop........ .................. stop (flush) all firewall rules -l|--list .......................... list all firewall rules -t|--status ........................ output firewall status log -e|--refresh ....................... refresh & resolve dns names in trust rules -a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and immediately load new rule into firewall -d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and immediately load new rule into firewall -u|--remove HOST ................... remove host from [glob]*_hosts.rules and immediately remove rule from firewall -o|--ovars ......................... output all configuration options |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
此外,APF自9.6 (rev:2)版本之后增加了RAB模块.该模块取代了旧版本的antidos模块.可有效减轻拒绝服务攻击带来的影响,但需要iptables的内核模块ipt_recent的支持.如下图我在VPS上启动APF后的屏显,提示RAB模块无法启用.内核模块ipt_recent没有找到.因此建议在内核支持以及iptables模块支持的情况下使用.
Faq
|
1 |
<pre class="wrap:true lang:default decode:true "> |
Problem: If you get this error apf(xxxxx): {glob} unable to load iptables module (ip_tables), aborting.
Solution: Try changing SET_MONOKERN=”0″ to SET_MONOKERN=”1″ , then apf -r
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
Problem: If you get this message: apf(xxxxx): {glob} !!DEVELOPMENT MODE ENABLED!! – firewall will flush every 5 minutes.
Solution: you need to change DEVEL_MODE=1 to DEVEL_MODE=0, make sure your config is working first.
|
1 |
<pre class="wrap:true lang:default decode:true "> |
|
1 |
<pre class="wrap:true lang:default decode:true "> |
Via:http://www.securecentos.com/basic-security/install-firewall/
