APF Configuratie functioneert niet

[Dennis]

Ik heb op een nieuwe server APF Firewall geinstalleerd. Dit is een firewall gebaseerd op iptables.

Ik wil poort 22 en 25 ip-restricted maken, echter lijkt dit maar niet te lukken. Op andere servers ging dit steeds goed met dezelfde configuratie.

Dit heb ik al gedaan:
• APF opnieuw geïnstalleerd
• Configuratie van meerdere andere servers gehaald (waar het functioneert)
• Oudere kernel geprobeerd
• Logs in /var/log/apf_log zijn hetzelfde als op andere servers

Op andere Centos-5 servers met dezelfde versie van iptables en APF functioneert alles correct. Ik vraag me dus echt af... waarom poort 25 en 22 niet geblokkeerd zijn op het moment. Gistermiddag leek het even te werken, echter nu weer niet.

/var/log/apf_log

[root@srv01 log]# cat apf_log
Jun 14 18:28:39 srv01 apf(13929): {glob} flushing & zeroing chain policies
Jun 14 18:28:39 srv01 apf(13929): {glob} firewall offline
Jun 14 18:28:39 srv01 apf(14000): {glob} activating firewall
Jun 14 18:28:40 srv01 apf(14040): {glob} determined (IFACE_IN) eth0 has address (censored,serverip)
Jun 14 18:28:40 srv01 apf(14040): {glob} determined (IFACE_OUT) eth0 has address (censored,serverip)
Jun 14 18:28:40 srv01 apf(14040): {glob} loading sysctl.rules
Jun 14 18:28:40 srv01 apf(14040): {glob} setting sysctl_logmartians disabled
Jun 14 18:28:40 srv01 apf(14040): {glob} setting sysctl_ecn disabled
Jun 14 18:28:40 srv01 apf(14040): {glob} setting sysctl_syncookies enabled
Jun 14 18:28:40 srv01 apf(14040): {glob} setting sysctl_overflow disabled
Jun 14 18:28:40 srv01 apf(14040): {glob} setting sysctl_tcp enabled
Jun 14 18:28:40 srv01 apf(14040): {glob} setting sysctl_syn enabled
Jun 14 18:28:40 srv01 apf(14040): {glob} loading preroute.rules
Jun 14 18:28:40 srv01 apf(14040): {glob} SET_REFRESH is set disabled
Jun 14 18:28:40 srv01 apf(14040): {glob} loading allow_hosts.rules
Jun 14 18:28:40 srv01 apf(14040): {trust} allow all to/from (censored)
hier nog enkele regels als die hierboven, met de ip's uit /etc/apf/allow_hosts (onze ip's)
Jun 14 18:28:40 srv01 apf(14040): {glob} loading bt.rules
Jun 14 18:28:40 srv01 apf(14040): {dshield} downloading http://feeds.dshield.org/top10-2.txt
Jun 14 18:28:40 srv01 apf(14040): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules
Jun 14 18:28:40 srv01 apf(14040): {dshield} loading ds_hosts.rules
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} set active PKT_SANITY
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ALL NONE
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs SYN,FIN SYN,FIN
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs SYN,RST SYN,RST
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs FIN,RST FIN,RST
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ACK,FIN FIN
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ACK,URG URG
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ACK,PSH PSH
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ALL FIN,URG,PSH
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ALL SYN,RST,ACK,FIN,URG
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ALL ALL
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp-flag pairs ALL FIN
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs ALL NONE
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs SYN,FIN SYN,FIN
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs SYN,RST SYN,RST
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs FIN,RST FIN,RST
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs ACK,FIN FIN
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs ACK,PSH PSH
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp-flag pairs ACK,URG URG
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny all fragmented udp
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny inbound tcp port 0
Jun 14 18:28:41 srv01 apf(14040): {pkt_sanity} deny outbound tcp port 0
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} set active BLK_P2P
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 1214
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 1214
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 2323
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 2323
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 4660:4678
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 4660:4678
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 6257
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 6257
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 6699
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 6699
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 6346
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 6346
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 6347
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 6347
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 6881:6889
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 6881:6889
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 6346
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 6346
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from tcp port 7778
Jun 14 18:28:41 srv01 apf(14040): {blk_p2p} deny all to/from udp port 7778
Jun 14 18:28:41 srv01 apf(14040): {glob} loading log.rules
Jun 14 18:28:41 srv01 apf(14040): {glob} virtual net subsystem disabled.
Jun 14 18:28:41 srv01 apf(14040): {glob} loading main.rules
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 21 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 53 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 80 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 106 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 110 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 111 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 113 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 143 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 443 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 465 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 993 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 995 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 2705 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 3306 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 8443 on 0/0
Jun 14 18:28:41 srv01 apf(14040): {glob} opening inbound tcp port 32768 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound udp port 53 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound udp port 111 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound udp port 631 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound udp port 789 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound udp port 32768 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound udp port 32769 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound icmp type 3 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound icmp type 5 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound icmp type 11 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound icmp type 0 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound icmp type 30 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} opening inbound icmp type 8 on 0/0
Jun 14 18:28:42 srv01 apf(14040): {glob} resolv dns discovery for (censored-dns1)
Jun 14 18:28:42 srv01 apf(14040): {glob} resolv dns discovery for (censored-dns2)
Jun 14 18:28:42 srv01 apf(14040): {glob} loading postroute.rules
Jun 14 18:28:42 srv01 apf(14040): {glob} default (egress) output accept
Jun 14 18:28:42 srv01 apf(14040): {glob} default (ingress) input drop
Jun 14 18:28:42 srv01 apf(14000): {glob} firewall initalized
Jun 14 18:28:42 srv01 apf(14000): {glob} fast load snapshot saved
[root@srv01 log]#

[Geert-Jan]

Post je apf.conf eens...

[Dennis]

#!/bin/sh
#
# APF 0.9.6 [apf@r-fx.org]
#
# NOTE: This file should be edited with word/line wrapping off,
# if your using pico please start it with the -w switch
# (e.g: pico -w filename)
#

##
# [Devel Mode]
# !!! Do not leave set to (1) !!!
# When set to enabled; 5 minute cronjob is set to stop the firewall. Set # this mode off (0) when firewall determined to be operating as desired.
##

# Set firewall cronjob (devel mode)
# 1 = enabled / 0 = disabled
DEVEL_MODE="0"

##
# [Main]
##

# The installation path of APF; this can be changed but it has not # been tested what would happen.
INSTALL_PATH="/etc/apf"

# Untrusted Network interface(s); all traffic on defined interface will be # subject to all firewall rules. This should be your internet exposed # interfaces. Only one interface is accepted for each value.
# NOTE: The interfacing structure is being worked towards support of MASQ/NAT IFACE_IN="eth0"
IFACE_OUT="eth0"

# Trusted Network interface(s); all traffic on defined interface(s) will by-pass # ALL firewall rules, format is white space or comma seperated list.
IFACE_TRUSTED=""

# Enable virtual network subsystem; creats independent policy ruleset for each # ip on a system (pulls data from 'ip addr list') to /etc/apf/vnet/ip.rules # Template is located in the vnet/ folder for rule files. This feature can # reduce apf start/stop performance and is not recommend for systems with more # than 255 (/24) ip's. [0 = Disabled / 1 = Enabled] SET_VNET="0"

# Support Monolithic kernel builds [no LKM's]. This mode of operation is # not really supported and you use at your own risk.
SET_MONOKERN="0"

# Verifies that all inbound traffic is sourced from a defined local gateway MAC # address. All other traffic that does not match this source MAC address will be # rejected as untrusted traffic. It is quite trivial to forge a MAC address and as # such this feature executes NO default accept policy against this MAC address.
VF_LGATE=""

# Verifies that the IF and IFACE_TRUSTED interfaces are actually routed (/sbin/route) # to something. If not then chances are APF will not start properly if at all.
VF_ROUTE="1"

# Verifies that crond service is running when DEVEL_MODE=1; if not then APF will not # try to load as if lock-up occures no cron service to flush firewall VF_CROND="1"

# Verifies that the current system uptime is greater than this value before APF # can activate. This is to prevent on-boot lockup issues or delays due to excessive # amount of firewall rules. Value is in seconds; should you wish to disable this # feature, simply set VF_UTIME to 0 value. !! NOTE: APF WILL NOT START ON IT's OWN; # IT WILL EXIT WITH FATAL ERROR BELOW SET UPTIME !!
VF_UTIME="0"

##
# [Packet Filtering/Handling]
##

# How to handle TCP packet filtering?
#
# RESET (sends a tcp-reset; TCP/IP default) # DROP (drop the packet; stealth ?) # REJECT (reject the packet) TCP_STOP="DROP"

# How to handle UDP packet filtering?
#
# RESET (sends a icmp-port-unreachable; TCP/IP default) # DROP (drop the packet; stealth ?) # REJECT (reject the packet) # PROHIBIT (send an icmp-host-prohibited) UDP_STOP="DROP"

# How to handle all other packet filtering? (icmp,arp,igmp) # # DROP (drop the packet) # REJECT (reject the packet) DSTOP="DROP"

# The sanity options control the way packets are scrutinized as # they flow through the firewall. The main PKT_SANITY option is a # top level toggle for all SANITY options and provides general # packet flag sanity as a pre-scrub for the other sanity options PKT_SANITY="1"

# Block any packets that do not conform as VALID; this feature # is safe for most but some may experience protocol issues with # broken remote clients PKT_SANITY_INV="0"

# Block any fragmented UDP packets; this is safe and no UDP # packets should ever be fragmented PKT_SANITY_FUDP="1"

# Block packets destination too or sourced from port 0 (Zero); this # is safe as nothing should communicate on port 0 (Zero) PKT_SANITY_PZERO="1"

# Block packets with stuffed routing
PKT_SANITY_STUFFED="0"

# Default Type of Service (TOS)
#
# These values should be set to a comma seperated list of ports # which you would like marked with the given TOS level #
# Set the default TOS value # Set the default TOS port range
TOS_DEF_TOS="4" TOS_DEF_RANGE="512:65535"
# 0: Ports for Normal-Service # 2: Ports for Minimize-Cost
TOS_0="" TOS_2=""
# 4: Ports for Minimize Delay - Maximize Reliability TOS_4="110,1110,465,993,995"
# 8: Ports for Maximum Throughput - Minimum Delay TOS_8="20,21"
# 16: Ports for No Delay - Moderate Throughput - High Reliability TOS_16="53,80,443"

# Allow traceroute requests on the defined range of ports. This feature # is not required for normal operations and some even desire it disabled.
# [0 = Disabled / 1 = Enabled]
# Enable Traceroute # Traceroute ports
TCR_PASS="1" TCR_PORTS="33434:33534"

# Set a reasonable packet/time ratio for ICMP packets; exceeding # such packet flow ratio will result in dropped packets.
# pkt/s (packets/seconds), pkt/m (packets/minutes) # Set value to 0 to disable, anything above is enabled ICMP_LIM="30/s"

# Use a dynamic discovery routine to parse and create rules based # on the local name servers defined in /etc/resolv.conf.
# [0 = Disabled / 1 = Enabled]
RESV_DNS="1"

# With RESV_DNS enabled; all untrusted name server traffic can fill # the logs with sport 53 traffic. This can be suppressed with an # implicit drop of all such traffic (sport 53 ingress) as so to avoid # the log chain.
RESV_DNS_DROP="1"

# A default drop for common p2p networks defined in the BLK_P2P_PORTS var; this # should be used on any server hosting and offering public services such as # web hosting and email services.
# [0 = Disabled / 1 = Enabled]
BLK_P2P="1"
BLK_P2P_PORTS="1214,2323,4660_4678,6257,6699,6346,6347,6881_6889, 6346,7778"

# You need multicasting if you intend to participate in the MBONE, a # high bandwidth network on top of the Internet which carries audio # and video broadcasts. More about MBONE at: www-itg.lbl.gov/mbone/, # this is generally safe to enable. [0 = Disabled / 1 = Enabled] BLK_MCATNET="0"

# Block all private ipv4 addresses; this is address space reserved # for private networks; or otherwise unroutable on the internet.
# If this host resides behind a firewall with NAT or routing scheme # that otherwise uses private addressing; leave this option off.
# Refer to the 'internals/private.networks' file for listing of # address space. [0 = Disabled / 1 = Enabled] BLK_PRVNET="0"

# Block all ipv4 address space marked reserved for future use or # unassigned; such networks have no business communicating with us.
# However they may at some point become live address space. Refer to # the 'internals/reserved.networks' file for listing of address space.
# [0 = Disabled / 1 = Enabled]
BLK_RESNET="0"

# Block all ident (tcp 113) requests in and out of the server IF the # port is not opened in *_TCP_CPORTS. This uses a reject target to # make sure the ident requests terminate quickly. You can see a marked # increase in irc and ftp connection performance with this feature.
BLK_IDENT="0"

# This is the maximum number of "sessions" (connection tracking entries) # that can be handled simultaneously by the firewall in kernel memory.
# Increasing this value too high will simply waste memory; setting it # too low may result in some or all connections being refused, in paticular # during denial of service attacks.
SYSCTL_CONNTRACK="34576"

# These are sysctl hook changes to further harden the kernel from # network attack trends by lowering standard time-out values and other # time based packet responces. [0 = Disabled / 1 = Enabled] SYSCTL_TCP="1"

# These are sysctl hook changes intended to help mitigate syn-flood # attacks by lowering syn retry, syn backlog & syn time-out values.
# [0 = Disabled / 1 = Enabled]
SYSCTL_SYN="1"

# These are sysctl hook changes to provide protection from spoofed # packets, and arp/route redirection. [0 = Disabled / 1 = Enabled] SYSCTL_ROUTE="0"

# This sysctl hook will log all network traffic that is otherwise # not to/from a local interface and not multicast.
# [0 = Disabled / 1 = Enabled]
SYSCTL_LOGMARTIANS="0"

# This sysctl hook will allow you to enable or disable ECN support # (Explicit Congestion Notification); this feature provides an # improved method for congestion avoidance by allowing the network # to mark packets for transmission later, rather than dropping them # from the queue. [0 = Disabled / 1 = Enabled] SYSCTL_ECN="0"

# This sysctl hook will allow you to enable or disable SynCookies # support; this feature will send out a 'syn-cookie' when the syn # backlog for a socket becomes overflowed. The cookie is used to # interrupt the flow of syn transmissions with a hashed sequence # number that must be corrilated with the sending host. The hash # is made up of the sending host address, packet flags etc...; # if the sending host does not validate against the hash then the # tcp hand-shake is terminated. [0 = Disabled / 1 = Enabled] # Note: syncookies seriously violates TCP protocol and can result
# in serious degradation of some services (i.e. SMTP);
# visible not by you, but your clients and relays whom are
# contacting your system.
SYSCTL_SYNCOOKIES="1"

# This sysctl hook will allow you to toggle Abort_On_Overflow support; # This feature will help mitigate burst floods if a listening service # is too slow to accept new connections. This option is an alternative # for SynCookies and both should NEVER be enabled at once.
# [0 = Disabled / 1 = Enabled]
# Note: This option can harm clients contacting your system. Enable
# option only if you are sure that the listening daemon can not
# be tunned to accept connections faster.
SYSCTL_OVERFLOW="0"

# Common drop ports; these are implicit ports you do not want logged # with the default drop chains. Format is comma seperated and underscore # seperator for ranges (135_139). Ports are droped and ignored for both # TCP & UDP as well as inbound and outbound.
CDPORTS="135_139,111,513,520,445,1433,1434,1234,1524,3127"

##
# [Ingress]
# Configure ingress (inbound) accepted services. This is an optional # feature; services and customized entries may be made directly to an ip's # virtual net file located in the vnet/ directory. Format is comma seperated # and underscore seperator for ranges.
#
# Example:
# IG_TCP_CPORTS="21,22,25,53,80,443,110,143,6000_7000"
# IG_UDP_CPORTS="20,21,53,123"
# IG_ICMP_TYPES="3,5,11,0,30,8"
##

# Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,53,80,106,110,111,113,143,443,465,993,995,2705, 3306,8443,32768"

# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53,111,631,789,32768,32769"

# Common ICMP (inbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any IG_ICMP_TYPES="3,5,11,0,30,8"

##
# [Egress]
# Configure egress (outbound) accepted services. This is an optional # feature; services and customized entries may be made directly to an ip's # virtual net file located in the vnet/ directory.
#
# Egress filtering is not required but makes your firewall setup complete # by providing full inbound and outbound packet filtering. You can toggle # egress filtering on or off with the EGF variable. Format is comma seperated # and underscore seperator for ranges.
#
# Example:
# EG_TCP_CPORTS="21,80,443,43"
# EG_UDP_CPORTS="20,21,53"
# EG_ICMP_TYPES="all"
##

# Egress filtering [0 = Disabled / 1 = Enabled] EGF="0"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,80,443,43"

# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

# Common ICMP egress (outbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any EG_ICMP_TYPES="all"

##
# [Egress UID match]
# Configure user-id specific egress (outbound) port access. This is a # more granular feature to limit the scope of egress packet flows with uid # conditioning. Format is comma seperated and underscore seperator for ranges.
#
# Format: EG_[TCP|UDP]_UID="uid:port"
# Example:
# Allow outbound access to destination port 22 for uid 0 # EG_TCP_UID="0:22"
##

# UID-Match egress (outbound) TCP ports
EG_TCP_UID=""

# UID-Match egress (outbound) UDP ports
EG_UDP_UID=""

##
# [Egress DROP CMD match]
# Configure executbale program names to DROP outgoing traffic for. This feature # denies the packets and logs them based on the CMD process field being passed # onto the netfilter functions so it can make use of the information.
#
# Format is comma seperated list of executable names you wish to ban from being # able to transmit data out of your server.
##

# CMD-Match egress (outbound) denied applications EG_DROP_CMD="eggdrop psybnc bitchx BitchX init udp.pl"

##
# [Imports]
# Configure importable rules
##
# DShield.org's "block" list of top networks that have exhibited # suspicious activity. [0 = Disabled / 1 = Enabled] USE_DS="1"

DS_URL="feeds.dshield.org/top10-2.txt" # block.txt url (no *://)
DS_URL_PROT="http" # protocol to use for wget

# This is an implamentation of the trust rules (allow/deny_hosts) but # on a global perspective. You can define below remote addresses from # which the glob_allow/deny.rules files should be downloaded from on # a daily basis. The files can be maintained in a static fashion by # leaving USE_RGT=0, appopriate for host serving the files.
# [0 = Disabled / 1 = Enabled]
USE_RGT="0"

GA_URL="yourhost.com/glob_allow.rules" # glob_allow.rules url (no *://)
GA_URL_PROT="http" # protocol for use with wget

GD_URL="yourhost.com/glob_deny.rules" # glob_deny.rules url (no *://)
GD_URL_PROT="http" # protocol for use with wget

# Update the reserved networks list in order to prevent new # ip assignments on the internet from getting blocked; this # option is only important when BLK_RESNET is set to enabled.
# [0 = Disabled / 1 = Enabled]
USE_RD="1"

RD_URL_PROT="http" # protocol to use for wget
RD_URL="r-fx.ca/downloads/reserved.networks" # reserved.networks url

# Import /etc/apf/ad/ad.rules ban list generated by antidos; # this is essentialy a quick enable/disable feature for # the insertion of such bans. [0 = Disabled / 1 = Enabled] USE_AD="0"

##
# [Logs]
# Logging and control settings
##

# Log traffic marked for log-drop or that reaches # the end of the firewall with no match. Disable # this option to reduce most output logging # [0 = Disabled / 1 = Enabled] LOG_DROP="0"

# What log level should we send all log data too?
# refer to syslog.conf for levels
LOG_LEVEL="crit"

# Where should we send all the logging data?
# ULOG (Allow ulogd to handle the logging) # LOG (Default; sends logging to kernel log) LOG_TARGET="LOG"

# Log interactive access over telnet & ssh; uses # custom log prefix of ** SSH ** & ** TELNET ** # [0 = Disabled / 1 = Enabled] LOG_IA="1"

# Log all forign gateway traffic
# [0 = Disabled / 1 = Enabled]
LOG_LGATE="0"

# Extended logging information; this forces the output of tcp options and # ip options for packets passing through the log chains # [0 = Disabled / 1 = Enabled] LOG_EXT="0"

# Max firewall events to log per/minute. Log events exceeding these limits # will be lost (1440 minutes/day * 30 events/minute = 43200 events per/day) LOG_RATE="30"

# Location of the apf status log; all startup, shutdown and runtime status # sends outputs to this file LOG_APF="/var/log/apf_log"

##
# [Import misc. vars]
##
#
# Internal vars file
CNFINT="$INSTALL_PATH/internals/internals.conf"
# Import internal vars file
. $CNFINT

[Geert-Jan]

Vreemd.... op zich geen gekke dingen. De IPtables / firewall in CentOS heb je uitgeschakeld, zodat die niet kan overrulen?

[Dennis]

Firewall in CentOS uitgeschakeld.
Firewall module Plesk niet geïnstalleerd.
SELinux uitgeschakeld.

Update
Het is gelukt! Ik heb APF eraf gegooid en ben gegaan voor de Plesk Firewall Module.
Nu gaat het goed! Heeft teveel uren gekost, dit zooitje!

Bedankt Geert-Jan!

[dreamhost_nl]

@Dennis : Heb je dat op je andere servers (waar het wel werkte) ook zo gedaan of is dit een alternatieve manier om het toch werkend te krijgen?

[Dennis]

Dreamhost_nl: Vanwege tijdgebrek heb ik geen tijd gehad uit te zoeken waarom APF niet werkte. Indien je geen gebruik maakt van Plesk, probeer dan eens CSF Firewall. CSF heeft een apf_uninstall.sh script. Wellicht gaat het dan wel goed!

De Plesk Firewall module werkt ook gewoon met iptables, dus waar het mis gaat is me nog een raadsel, gezien op andere servers dezelfde kernel, apf- en iptablesversie, en apf-configuratie gedraaid wordt, waar het wel functioneert.

[Apoc]

APF wordt ook al tijden niet meer geupdate - de "opvolger" is inderdaad CSF en dat werkt prima.

[dreamhost_nl]

@Dennis: CSF/LFD wordt hier inderdaad ook al tijden gebruikt. Overigens bedankt voor de suggestie. Ik sluit me er bij aan.
Ik vroeg me alleen af of je nu afgeweken was van de manier waarop je het altijd doet of dat je daarvoor af was geweken van hetgeen je normaal doet, maar het is me inmiddels duidelijk... :)