View source for Installing Advanced Policy Firewall and Brute Force Detection


== Install Required Packages ==

'''If server does not have required packages, here is what you need.'''

Before installing APF and BFD, install essential packages:

'''sudo apt update && sudo apt install wget curl tar unzip -y'''

== Install APF (Advanced Policy Firewall) ==

'''cd /usr/local/src'''

'''sudo wget https://www.rfxn.com/downloads/apf-current.tar.gz'''

'''sudo tar -xzf apf-current.tar.gz'''

'''cd apf-*'''

'''sudo ./install.sh'''

== Configure APF ==

Edit the main config file:

  bash 
 
  sudo nano /etc/apf/conf.apf 
 
'''Key options to tweak:'''

DEVEL_MODE="1" → Change to "0" after confirming it works (default 5 min timeout for testing).

IG_TCP_CPORTS: Incoming TCP ports you want open (e.g., 22,80,443,21).

IG_UDP_CPORTS: Incoming UDP ports (e.g., 53 for DNS).

EGF="1": Enables egress filtering (optional, advanced setups).

== Start APF ==

  sudo /usr/local/sbin/apf -r  

'''To test that it's working and not locking you out (important if remote):'''

  sudo /usr/local/sbin/apf --status  

'''Once confirmed:'''
  sudo nano /etc/apf/conf.apf  
  # Set: DEVEL_MODE="0"  
  sudo /usr/local/sbin/apf -r

'''Enable APF at boot:'''

  sudo systemctl enable apf  

== Install BFD (Brute Force Detection) ==

'''Download and Install'''

  cd /usr/local/src  
  sudo wget https://www.rfxn.com/downloads/bfd-current.tar.gz  
  cd bfd-*  
  sudo ./install.sh  

'''Configure BFD'''

Edit the config file:

  sudo nano /usr/local/bfd/conf.bfd

Recommended settings:

EMAIL_ALERTS="1"

EMAIL_ADDRESS="your@email.com"

TRIG="20" (number of failed attempts before blocking)

Optional: edit rules in /usr/local/bfd/rules/ (e.g., sshd, pure-ftpd, etc.).

Save and exit.