Skip to content
SPECIFICTION
Get listed

Advanced Policy Firewall

rfxn.com

Free plan LinuxSelf-hosted
Visit rfxn.com
Spec score 8.2 #8 of 31 in Malware removal tools

What it is

Advanced Policy Firewall is a free GNU GPL firewall system for Internet-deployed Linux servers. It uses iptables/netfilter to combine static rules, stateful connection policies, and checks for attack patterns and forged source addresses. Administrators can configure granular inbound and outbound filtering, including rules based on users and applications. Additional controls include reactive address blocking, GeoIP country filtering, and Spamhaus and DShield lists. IPv6 dual-stack filtering can create ip6tables rules automatically. Documentation describes snapshots loading more than 1,000 rules in under one second, plus integrations with BFD, cron, systemd, Docker/Kubernetes, and logrotate. APF requires Linux, iptables/netfilter, and Bash, and supports legacy and nft backends. Listed systems include RHEL/Rocky/AlmaLinux 8 and 9, CentOS 6 and 7, Debian 12, and Ubuntu 12.04, 20.04, and 24.04. Development mode initially flushes the firewall every five minutes; only SSH port 22 is open by default.

Spec sheet

Purpose
APF is an iptables/netfilter-based firewall system designed for Internet-deployed Linux servers.Read 8 Oct 2026 · rfxn.com
Supported platforms
LinuxRead 22 Sep 2026 · rfxn.com
Free plan
YesRead 22 Sep 2026 · rfxn.com
Integrations
The documentation describes integration with BFD, cron, systemd, Docker/Kubernetes, and logrotate.Read 8 Oct 2026 · rfxn.com
Support
The maker directs users to the APF source repository and invites bug reports and feature requests through its issue tracker.Read 8 Oct 2026 · rfxn.com
Founded
2002Read 28 Sep 2026 · rfxn.com
Application rules
YesRead 22 Sep 2026 · rfxn.com
Blocking
Features include reactive address blocking, GeoIP country filtering, and Spamhaus and DShield block lists.Read 8 Oct 2026 · rfxn.com
Configuration limit
Only SSH port 22 is open by default, while outbound filtering, reactive address blocking, and virtual network policies are disabled by default.Read 8 Oct 2026 · rfxn.com
Filtering
Its filtering combines static rules, connection-based stateful policies, and sanity checks for attack patterns and source IP forgery.Read 8 Oct 2026 · rfxn.com
IPv6
APF supports IPv6 dual-stack filtering with automatic ip6tables rules.Read 8 Oct 2026 · rfxn.com
License and price
APF is distributed under GNU GPL without restrictions on use or redistribution, and R-fx Networks says its projects have no paid tiers or enterprise editions.Read 8 Oct 2026 · rfxn.com
Outbound control
advancedRead 22 Sep 2026 · rfxn.com
Performance
The documentation says fast-load snapshots can load more than 1,000 rules in under one second.Read 8 Oct 2026 · rfxn.com
Requirements
APF requires a Linux system with iptables/netfilter and Bash; the documentation supports both legacy and nft iptables backends.Read 8 Oct 2026 · rfxn.com
Rule direction
bothRead 22 Sep 2026 · rfxn.com
Safety behavior
Development mode is enabled by default and flushes the firewall every five minutes to help prevent lockout during initial configuration.Read 8 Oct 2026 · rfxn.com
Security reporting
R-fx Networks asks for vulnerability reports to be sent privately and says it will acknowledge receipt within 48 hours.Read 8 Oct 2026 · rfxn.com
Supported systems
The documentation lists RHEL/Rocky/AlmaLinux 8 and 9, CentOS 7 and 6, Debian 12, and Ubuntu 20.04, 24.04, and 12.04.Read 8 Oct 2026 · rfxn.com
Traffic controls
It supports granular inbound and outbound filtering, including user- and application-based outbound rules.Read 8 Oct 2026 · rfxn.com

Plans and prices

Advanced Policy Firewall Free GNU GPL v2 · no paid tiers or enterprise editions Read 8 Oct 2026 · rfxn.com

Every Advanced Policy Firewall plan and price →

Strong points and limits

Strong points

  • Granular inbound and outbound filtering
  • User- and application-based outbound rules
  • IPv6 dual-stack filtering with automatic ip6tables rules
  • GeoIP, Spamhaus, and DShield blocking
  • No paid tiers or enterprise editions

Limits

  • Only SSH port 22 is open by default
  • Outbound filtering is disabled by default
  • Development mode flushes the firewall every five minutes
  • Requires Linux, iptables/netfilter, and Bash

Who it suits

APF suits administrators protecting self-hosted Linux servers who need inbound and outbound policy controls. It requires familiarity with Linux firewall components and the listed system requirements.

Verdict

Advanced Policy Firewall provides broad rule and blocking controls for Linux server deployments at no license cost. Its defaults prioritize avoiding lockout during setup, so administrators must configure disabled protections and policies.

Where Specifiction places it

Alternatives to Advanced Policy FirewallAll alternatives →