Advanced Policy Firewall (APF) is a user-friendly firewall interface that simplifies managing network security on Linux servers. It works as a wrapper for iptables, making it easy to block malicious traffic and whitelist trusted IP addresses without dealing with complex firewall commands. OBHost servers often use APF to provide robust security while keeping server management straightforward for customers.
What Is APF Firewall?
APF is a rule-based firewall designed for Linux servers running CentOS and similar distributions. Instead of working directly with iptables (which can be complicated and error-prone), APF provides simple commands and configuration files that anyone can manage. All configuration files are stored in the /etc/apf folder on your server.
The two most important files you'll work with are:
- allow_hosts.rules - Contains whitelisted IP addresses that are always permitted to access your server
- deny_hosts.rules - Contains blocked IP addresses that cannot access your server
How to Block an IP Address with APF
Blocking unwanted IP addresses is one of the most common firewall tasks. APF gives you two simple methods to accomplish this.
Method 1: Edit the Deny Hosts File
Open the deny hosts configuration file using your preferred text editor:
vim /etc/apf/deny_hosts.rules
Add the IP address you want to block at the bottom of the file, save the changes, and exit. Each IP address should be on its own line.
Method 2: Block via Command Line (Faster)
The quickest way to block an IP address is through a simple command:
apf -d <ipaddress>
Replace <ipaddress> with the actual IP you want to block. This command immediately adds the IP to your deny list.
After making any changes to APF rules, always restart the firewall to apply them:
apf -r
How to Allow an IP Address with APF
Whitelisting trusted IP addresses ensures they can always access your server, even if your firewall rules become more restrictive.
Method 1: Edit the Allow Hosts File
Open the allow hosts configuration file:
vim /etc/apf/allow_hosts.rules
Add the IP address you want to whitelist at the bottom of the file. Save your changes and exit the editor.
Method 2: Allow via Command Line (Faster)
Use this command to quickly whitelist an IP address:
apf -a <ipaddress>
Replace <ipaddress> with the IP you want to allow. Remember to restart APF after making changes:
apf -r
Essential APF Commands
Here are the most useful APF commands for managing your firewall from the command line:
- apf -s - Start the APF firewall
- apf -r - Restart APF and reload all rules (use after making changes)
- apf -f - Stop APF and flush all firewall rules
- apf -l - List all current firewall rules
- apf -t - Check the current firewall status
- apf -u <ipaddress> - Remove an IP address from both deny and allow lists
Important: Always restart APF after modifying any rules to ensure your changes take effect. The restart command (apf -r) is essential for applying your security updates.
APF Best Practices
When managing your firewall with APF, keep these tips in mind:
- Always test new rules carefully to avoid locking yourself out of your server
- Keep your allow_hosts.rules file updated with your current IP addresses
- Regularly review your deny_hosts.rules to remove outdated blocks
- Document why you blocked or allowed specific IP addresses for future reference
- Restart APF after every configuration change to activate new rules
Frequently Asked Questions
What happens if I accidentally block my own IP address?
If you block your own IP address, you'll lose access to your server through that connection. To prevent this, always add your IP to the allow_hosts.rules file before making other changes. If you get locked out, you'll need to access your server through an alternative method (like a different network or through your hosting control panel) to remove your IP from the deny list using the apf -u command.
Do I need to restart APF after every rule change?
Yes, you must restart APF using apf -r after making any changes to rules, whether through configuration files or command-line commands. Without restarting, your changes won't take effect and your firewall will continue using the old rules.
Can I block entire IP ranges with APF?
Yes, APF supports CIDR notation for blocking IP ranges. For example, you can block an entire subnet by adding entries like 192.168.1.0/24 to your deny_hosts.rules file. This blocks all IP addresses from 192.168.1.0 to 192.168.1.255 with a single rule.
How do I check if an IP address is currently blocked?
Use the apf -l command to list all active firewall rules. You can also check the /etc/apf/deny_hosts.rules file directly to see if an IP address is listed there. Additionally, you can use grep to search for a specific IP: grep '192.168.1.1' /etc/apf/deny_hosts.rules.
If you need assistance configuring APF firewall on your server or have questions about server security, the OBHost support team is available 24/7 to help. Visit https://www.obhost.net/contact or email support@obhost.org for expert guidance.
