How do I install APF firewall into the VE?

The installation of APF requires some additional steps to be taken on the hardware node.

1. First of all, you should define which iptables modules are available for VEs.

Edit /etc/sysconfig/iptables-config file on a Virtuozzo hardware node:
IPTABLES_MODULES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"

Edit /etc/sysconfig/vz file on a Virtuozzo hardware node:
IPTABLES="ipt_REJECT
ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"

Please note – iptables modules list in IPTABLES and IPTABLES_MODULES parameters in /etc/sysconfig/vz and /etc/sysconfig/iptables-config files should be placed in one single line, no linebreaks is allowed in this parameter.

Restart Virtuozzo. All VEs will be restarted.
# service vz restart

2. Increase ‘numiptent’ parameter for the VE you need to install APF into. This parameter limits the amount of iptables rules available for a VE. Default APF configuration requires ~400 rules. Lets set it to 400 in the example below for VE #101:
# vzctl set 101 --numiptent 400 --save

3. Install APF inside the VE. Edit /etc/apf/conf.apf inside VE, set the following parameters:
IFACE_IN="venet0"
IFACE_OUT="venet0"
SET_MONOKERN="1"

4. Start APF inside the VE:
# /etc/init.d/apf start

Uninstall APF

Sometimes we may require to remove APF from the server. Here is a guide which shows how to remove APF completely from the server.

Stop the firewall first
service apf stop
/bin/rm -rfv /etc/apf
Remove the cron for APF
/bin/rm -fv /etc/cron.daily/fw
/bin/rm -fv /etc/init.d/apf
lastly disable at startup
chkconfig apf off

This should remove APF completely from the server as we removed the APF daemon, cron and files.

APF installation error on VPS : unable to load iptables module (ip_tables), aborting.

While installing APF on your VPS you get the following error :

# apf -r
apf(28442): {glob} status log not found, created
apf(28463): {glob} flushing & zeroing chain policies
apf(28463): {glob} firewall offline
apf(28500): {glob} activating firewall
apf(28551): {glob} unable to load iptables module (ip_tables), aborting.
apf(28500): {glob} firewall initalized
apf(28500): {glob} !!DEVELOPMENT MODE ENABLED!! – firewall will flush every 5 minutes.

You need to configure the APF for your VPS.

nano -w /etc/apf/conf.apf

modify
SET_MONOKERN=”0″

to
SET_MONOKERN=”1″

Restart APF

apf -r

Now you will be able to complete apf installation fine :)

cPanel required ports list

Cpanel required ports list

PortServiceProtocolDirectionNotes
20ftptcpinbound/outbound
21ftptcp,udpinbound/outbound
22sshtcpinbound
25smtptcpinbound/outbound
26smtptcpinbound/outbound
37rdatetcpoutbound
43whostcpoutbound
53DNStcp/udpinbound/outbound Inbound only needed if you run your own DNS server
80httptcpinbound/outbound
110pop3tcpinbound
113identtcpoutbound
143imap4tcpinbound
443httpstcpinbound
465smtptcp/ssl, tcp/udpinbound/outbound
873rsynctpc/udpoutbound
993imap4ssl tcpinbound
995pop3ssl tcpinbound
2082cpaneltcpinbound
2083cpanelssl tcpinbound
2086whmtcpinbound
2087whm ssltcpinbound
2089cp licensetcpoutbound
2095webmailtcpinbound
2096webmailssl tcpinbound
3306mysqltcpinboundOnly if you need to connect remotely
6666chattcpinbound