Results 1 to 10 of 41

Thread: How-To: UFW

Threaded View

  1. #1
    cprofitt's Avatar
    cprofitt is offline νόησις νοήσεως - nóesis noéseos
    Join Date
    Oct 2006
    Location
    平静
    Beans
    1,449
    Distro
    Ubuntu Development Release

    How-To: UFW - Ucomplicated Firewall

    I looked for a current how-to for UFW and when I did not see one I wanted to add one.

    (important note: UFW is not the firewall. UFW just configures your iptables)

    in most cases I recommend doing the following immediately:

    Code:
    sudo ufw default deny
    sudo ufw enable
    Then fine tuning can start:

    Some basic commands are:

    Turn on the firewall

    Code:
    sudo ufw enable
    Turn off the firewall
    Code:
    sudo ufw disable


    To add deny rules:

    blocking a port
    Code:
    sudo ufw deny port <port number>

    blocking an ip address

    Code:
    sudo ufw deny from <ip address>
    blocking a specific ip address and port
    Code:
    sudo ufw deny from <ipaddress> to port <port number>
    advanced deny example for denying access from an ip address range 10.120.0.1 - 10.120.0.255 for SSH port 22
    Code:
    sudo ufw deny from 10.0.0.1/24 to any port 22


    To add allow rules:

    to allow an ip address
    Code:
    sudo ufw allow from <ip address>
    to allow a port
    Code:
    sudo ufw <port number>
    allow a specific ip address and port
    Code:
    sudo ufw allow from <ipaddress> to any port <port number>
    advanced allow example for allowing access from an ip address range 10.120.0.1 - 10.120.0.255 to port 22
    Code:
    sudo ufw allow from 10.0.0.0/24 to any port 22

    To get the current status of your UFW rules

    Code:
    sudo ufw status
    To remove a deny or allow rule
    Code:
    sudo ufw delete <rule type> from <ip address> to any port <port number>
    (note: you basically match the syntax for the creation of the rule and add 'delete')

    You need to be careful with setting up allow and deny rules that 'intersect' because the first rule matched is applied and the remaining are ignored.

    SECNARIO:

    you want to block access to port 22 from 192.168.0.1 and 192.168.0.7 but allow all other 192.168.0.x IPs to have access to port 22

    Code:
    sudo ufw deny from 192.168.0.1 to any port 22
    sudo ufw deny from 192.168.0.7 to any port 22
    sudo ufw allow from 192.168.0.0/24 to any port 22
    if you do the allow statement before either of the deny statements it will be matched first and the deny will not be evaluated.

    you can check this by checking ufw status
    Code:
    sudo ufw status
    To                         Action  From
    --                         ------  ----
    22:tcp                     DENY    192.168.0.1
    22:udp                     DENY    192.168.0.1
    22:tcp                     DENY    192.168.0.7
    22:udp                     DENY    192.168.0.7
    22:tcp                     ALLOW   192.168.0.0/24
    22:udp                     ALLOW   192.168.0.0/24
    the allow is at the bottom and will be the last command evaluated if it appeared above the deny rules the deny rules would not be evaluated.

    I hope this helps you use ufw to secure your computer.

    Link to the documentation wiki
    Last edited by cprofitt; June 9th, 2008 at 09:40 PM.

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •