APF<\/span><\/strong><\/p>\nTo configure APF is pretty easy and I will touch on a few of the config file options\u00a0in this document. All of the options are covered in great detail on their website and well\u00a0commented in the conf.apf file.<\/p>\n
The config file for APF lives in \/etc\/apf and is called conf.apf<\/p>\n
We will need to edit the conf.apf file, I like to use vi but any command line editor\u00a0will work.<\/p>\n
If you have multiple interfaces on your trixbox setup, you will want to set the\u00a0IFACE_IN and IFACE_OUT to your external interface. This is the, untrusted network\u00a0interface that is connected to the internet. If you have a second card eth1, that is used<\/p>\n
for internal network, trusted network, you can set the IFACE_TRUSTED to this\u00a0interface. Please see the comments in the conf.apf if you are uncertain.<\/p>\n
The setup script will try to properly determine which interface is used for\u00a0untrusted network and place it in the appropriate field.<\/p>\n
I like to change the value of the SET_TRIM to 0. This value sets the total amount\u00a0of rules allowed inside of the deny trust system. It is designed to save memory and start\u00a0time. With the default value of 50, the system will start to purge old rules once this<\/p>\n
number is met. With the inclusion of BFD, this number will generally climb past 50.<\/p>\n
Setting this value to 0 will disable this feature.<\/p>\n
SET_TRIM=\u201d0\u201d<\/em><\/strong><\/p>\nAPF has the ability to do QoS on packets, this is defined with the TOS values in\u00a0the conf.apf. For SIP and IAX, I set the following.<\/p>\n
TOS_8=”21,20,80,4569,5060,10000_20000″<\/em><\/strong><\/p>\nThis also requires a small tweak to one of the config files that I will discuss later\u00a0in the document in order to tag UDP packets.<\/p>\n
Since we changed the SSH port to a different number, we have to tweak the\u00a0conf.apf to match this new port.<\/p>\n
HELPER_SSH_PORT=”2222″<\/em><\/strong><\/p>\nMake sure to place the correct port number that you decided to run SSH on.<\/p>\n
Ingress filtering is used to open inbound ports for access, both TCP and UDP have\u00a0separate settings. For a trixbox setup, the following ports should be open, both TCP and\u00a0UDP are listed. If you are not using tftp, then do not have port 69 open. Do not forget to\u00a0change the SSH port from 22, to the port you choose to run SSH on. Otherwise you will\u00a0be locked out, here we are using port 2222 from our example above. I have not included\u00a0IAX ports in this setup. There is a easy way to ensure that only specific hosts can use\u00a0IAX that I will cover later. This is handy if you use IAX to do interoffice trunks like I\u00a0do, but don’t want IAX ports open for the world to see.<\/p>\n
IG_TCP_CPORTS=”2222,69,80,5060,6600,10000_20000″<\/em><\/strong><\/p>\nIG_UDP_CPORTS=”69,5060,10000_20000″<\/em><\/strong><\/p>\nEgress filtering is used to allow outbound filtering. I don’t use egress filtering and\u00a0it will not be covered in this document. It is set to EGF=\u201d0\u201d , or disabled by default.<\/p>\n
In the section of the conf.apf file called Imported Rules, there are settings for\u00a0various feeds. Some of these feeds are very handy and I use them all. I have even setup\u00a0my own custom feed that allows me to tweak all of my servers with global deny rules.<\/p>\n
You can disable or enable this feature with the USE_DS setting. A \u201c1\u201d is enabled, a \u201c0\u201d\u00a0is disabled.<\/p>\n
We are now ready to start APF for the first time. Double check that the SSH port\u00a0is set correctly to the one you are using. If you start APF right now and something is\u00a0wrong, it will disable itself in 5 minutes. This is called DEVEL_MODE and is the first<\/p>\n
setting in the conf.apf file. Leave this set to \u201c1\u201d until you are certain you can get in via\u00a0ssh and things are working.<\/p>\n
To see a list of command line options run apf <\/em>without any flags.<\/p>\n[trixbox1.localdomain apf]# apf<\/em><\/strong><\/p>\napf(3402): {glob} status log not found, created<\/em><\/p>\nAPF version 9.6 <apf@r-fx.org><\/em><\/p>\nCopyright (C) 1999-2007, R-fx Networks <proj@r-fx.org><\/em><\/p>\nCopyright (C) 2007, Ryan MacDonald <ryan@r-fx.org><\/em><\/p>\nThis program may be freely redistributed under the terms of the GNU GPL<\/em><\/p>\nusage \/usr\/local\/sbin\/apf [OPTION]<\/em><\/p>\n-s|–start ……………………. load all firewall rules<\/em><\/p>\n-r|–restart ………………….. stop (flush) & reload firewall rules<\/em><\/p>\n-f|–stop…….. ……………… stop (flush) all firewall rules<\/em><\/p>\n-l|–list …………………….. list all firewall rules<\/em><\/p>\n-t|–status …………………… output firewall status log<\/em><\/p>\n-e|–refresh ………………….. refresh & resolve dns names in trust rules<\/em><\/p>\n-a HOST CMT|–allow HOST COMMENT … add host (IP\/FQDN) to allow_hosts.rules and<\/em><\/p>\nimmediately load new rule into firewall<\/em><\/p>\n-d HOST CMT|–deny HOST COMMENT …. add host (IP\/FQDN) to deny_hosts.rules and<\/em><\/p>\nimmediately load new rule into firewall<\/em><\/p>\n-u|–remove HOST ………………. remove host from [glob]*_hosts.rules<\/em><\/p>\nand immediately remove rule from firewall<\/em><\/p>\n-o|–ovars ……………………. output all configuration options<\/em><\/p>\nTo start APF we issue the following command.<\/em><\/p>\n[trixbox1.localdomain apf]# apf -s<\/em><\/p>\napf(3445): {glob} activating firewall<\/em><\/p>\napf(3489): {glob} determined (IFACE_IN) eth0 has address 192.168.1.31<\/em><\/p>\napf(3489): {glob} determined (IFACE_OUT) eth0 has address 192.168.1.31<\/em><\/p>\napf(3489): {glob} loading preroute.rules<\/em><\/p>\napf(3489): {resnet} downloading http:\/\/r-fx.ca\/downloads\/reserved.networks<\/em><\/p>\napf(3489): {resnet} parsing reserved.networks into<\/em><\/p>\n\/etc\/apf\/internals\/reserved.networks<\/em><\/p>\napf(3489): {glob} loading reserved.networks<\/em><\/p>\napf(3489): {glob} SET_REFRESH is set to 10 minutes<\/em><\/p>\napf(3489): {glob} loading bt.rules<\/em><\/p>\napf(3489): {dshield} downloading http:\/\/feeds.dshield.org\/top10-2.txt<\/em><\/p>\napf(3489): {dshield} parsing top10-2.txt into \/etc\/apf\/ds_hosts.rules<\/em><\/p>\napf(3489): {dshield} loading ds_hosts.rules<\/em><\/p>\napf(3489): {sdrop} downloading http:\/\/www.spamhaus.org\/drop\/drop.lasso<\/em><\/p>\napf(3489): {sdrop} parsing drop.lasso into \/etc\/apf\/sdrop_hosts.rules<\/em><\/p>\napf(3489): {sdrop} loading sdrop_hosts.rules<\/em><\/p>\napf(3489): {glob} loading common drop ports<\/em><\/p>\n………..trimmed for this document………<\/em><\/p>\napf(3489): {glob} default (ingress) input drop<\/em><\/p>\napf(3445): {glob} firewall initalized<\/em><\/p>\napf(3445): {glob} !!DEVELOPMENT MODE ENABLED!! – firewall will flush every 5\u00a0minutes.<\/em><\/p>\nWe can see that APF has started, downloaded some rules from dshield.org and\u00a0spamhaus.org and then told us it is in DEVELOPMENT MODE. Now test connecting\u00a0to your server over SSH to ensure that you have setup the correct port number ingress.<\/p>\n
If you can’t connect, you will have to wait 5 minutes and then APF will shutdown. Once\u00a0you are sure you can get in with SSH we can change the conf.apf file from\u00a0DEVEL_MODE=”1″ to DEVEL_MODE=”0″ and restart\/start APF. APF will start and\u00a0not warn you about being in DEVELOPMENT MODE, your firewall should be good to\u00a0go.<\/p>\n
APF additional tweaks. This setup might not be ideal for everyone. If you\u00a0connect to your provider over IAX then you will definitely want to add the IAX ports to\u00a0the conf.apf. However if you have two or more systems that you connect to each other\u00a0over IAX for interoffice connections, then this is the way to go. This will work with\u00a0static IP addresses and DYNDNS setups alike. You can use a fully qualified DNS\u00a0hostname or IP address. One of the flags for the apf command is -a, which is allow.<\/p>\n
This will globally allow a host to connect to this system, bypassing the firewall rules. I\u00a0can’t stress how handy this is. Some examples are allowing a SNMP query, IAX\u00a0connections, or other ports that you do not want open, but need to allow specific hosts to<\/p>\n
connect to. To do this just issue the following command, substitute your remote system\u00a0IP address with the one I have here.<\/p>\n
apf -a 192.168.1.216<\/strong><\/em><\/p>\nThis will allow the system 192.168.1.216 to connect to any port on the firewalled\u00a0server, thereby bypassing the firewall rules. If you are running APF on both systems, be\u00a0sure to do the same thing on the other host using the correct IP address.<\/p>\n
APF also allows a system admin to block a host or a complete subnet. This is\u00a0handy if you see someone attempting to connect to your machine over ftp, telnet, ssh,\u00a0etc.. To block a specific host use the following, be sure to use the IP you want to block.<\/p>\n
apf -d 192.168.1.216<\/strong><\/em><\/p>\nTo block a complete subnet (CIDR) the command is very similar.<\/p>\n
apf -d 202.86.128.0\/24<\/strong><\/em><\/p>\nThis will block the entire subnet. You can sometimes get the subnet (CIDR)\u00a0listing using a whois on the IP address. You can also lookup a CIDR by ip on google or\u00a0ripe.net. Be sure that the subnet is not one you are in or you could lock yourself out.<\/p>\n
TOS for UDP packets are not defined for APF. Only TCP packets have the TOS\u00a0bit set. There is a easy way to fix this. In the \/etc\/apf\/internals folder is a file called,\u00a0functions.apf. We need to edit this file manually. It is pretty straight forward as to what\u00a0we need to changed, so don’t worry.<\/p>\n
There are several places we have to add a single line. Look for the TOS_ section\u00a0in the functions.apf. It will look like this.<\/p>\n
if [ ! “$TOS_0” == “” ]; then<\/strong><\/em><\/p>\nfor i in `echo $TOS_0 | tr ‘,’ ‘ ‘`; do<\/strong><\/em><\/p>\ni=`echo $i | tr ‘_’ ‘:’`<\/strong><\/em><\/p>\n$IPT -t mangle -A PREROUTING -p tcp –sport $i -j TOS –set-tos 0<\/strong><\/em><\/p>\ndone<\/strong><\/em><\/p>\nfi<\/strong><\/em><\/p>\nWe have to add the settings for UDP. We copy one line and change tcp to upd. A\u00a0sample is below, highlighted in red.<\/p>\n
if [ ! “$TOS_0” == “” ]; then<\/strong><\/em><\/p>\nfor i in `echo $TOS_0 | tr ‘,’ ‘ ‘`; do<\/strong><\/em><\/p>\ni=`echo $i | tr ‘_’ ‘:’`<\/strong><\/em><\/p>\n$IPT -t mangle -A PREROUTING -p tcp –sport $i -j TOS –set-tos 0<\/strong><\/em><\/p>\n$IPT -t mangle -A PREROUTING -p udp –sport $i -j TOS –set-tos 0<\/strong><\/em><\/p>\ndone<\/strong><\/em><\/p>\n
![\"\"](\"http:\/\/blog.1oc.com\/wp-content\/uploads\/2008\/12\/picture-11.png\" "\\"picture-11\\"")
<\/a><\/p>\n