Results 1 to 8 of 8

Thread: ufw: remote set up of first firewall

  1. #1
    Join Date
    Aug 2010
    Beans
    24

    Question ufw: remote set up of first firewall

    I am learning to set up my very first firewall remotely over SSH.

    Since ufw is the default firewall front end with ubuntu, that's what I am learning to use. As I go along, I am trying to document the process:
    http://linux.overshoot.tv/wiki/serve...cated_firewall

    Despite all the existing documentation I found on the web, I already have a question. Two, actually.

    1) If one accidentally locks himself out and cannot reconnect to the remote server via SSH, what is the 'normal' process to recover control of the server?

    2) In the wiki page linked above, I tried to document a method that I thought would allow a new sysadmin to test the new firewall without getting locked up. However, when I look at the iptables rules, I don't get the result I expected:
    On a new system, there are absolutely no rules:
    Code:
    # iptables -L -n -v
    Chain INPUT (policy ACCEPT 2793K packets, 569M bytes)
     pkts bytes target     prot opt in     out     source               destination         
    
    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination         
    
    Chain OUTPUT (policy ACCEPT 1768K packets, 5488M bytes)
     pkts bytes target     prot opt in     out     source               destination
    Enable ufw:
    Code:
    ufw enable
    then check the output of iptables again (same command as above): this time we have a loooooong list of rules, those enabled by default by ufw.

    Disable ufw:
    Code:
     ufw disable
    I kind of expected at this time for the iptable rules to be back to the empty set we had at the beginning. However, we still have all the rules that were added when we first enabled ufw.

    What does this imply? Do those rules apply? Is there an effective firewall?
    Is my logic somehow faulty in the 'Setting up your first firewall' section of the wiki here:
    http://linux.overshoot.tv/wiki/serve...cated_firewall
    ??

    Thank you for any insight that you can provide.
    Last edited by AugustinMa; April 28th, 2012 at 05:46 PM.

  2. #2
    Join Date
    Aug 2010
    Beans
    24

    Re: ufw: remote set up of first firewall

    I guess what I am asking is: if I disable ufw, how can I be sure that no firewall is running?

  3. #3
    Join Date
    Aug 2010
    Beans
    24

    Re: ufw: remote set up of first firewall

    This is all so confusing to me... :-/

  4. #4
    Join Date
    Nov 2009
    Location
    Mataro, Spain
    Beans
    14,013
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: ufw: remote set up of first firewall

    I think there are no rules active after you disable ufw. The iptables command might still list them because I think the rules are reloaded the next time you enable ufw.

    Recently I used ufw for the first time too, but later found out that using iptables directly seemed a better choice. Tutorials that you find about iptables might look complicated but you also need to look out for the dates. In time, controlling iptables has gotten easier, so older tutorials might look frightening to a beginner.

    Are you getting stuck with ufw at some exact point or just asking in general?
    Darko.
    -----------------------------------------------------------------------
    Ubuntu 14.04 LTS 64bit & Windows 10 Pro 64bit

  5. #5
    Join Date
    Aug 2010
    Beans
    24

    Re: ufw: remote set up of first firewall

    Quote Originally Posted by darkod View Post
    I think there are no rules active after you disable ufw. The iptables command might still list them because I think the rules are reloaded the next time you enable ufw.

    Recently I used ufw for the first time too, but later found out that using iptables directly seemed a better choice. Tutorials that you find about iptables might look complicated but you also need to look out for the dates. In time, controlling iptables has gotten easier, so older tutorials might look frightening to a beginner.

    Are you getting stuck with ufw at some exact point or just asking in general?

    Thank you Darkod for your reply.

    I am asking because I urgently need to set up a firewall, the first time I do so remotely, and I like to understand what I am doing before I do it. I don't want to be logged out.

    Also, I like to document things as I go along, provide answers that I myself was having during my own learning process. Thus, it is not enough for me to get an answer in a forum and get the job done, I also want to write something that can help future newbies who may encounter the very same problem.

    I had started writing the following tutorials using iptables:
    http://linux.overshoot.tv/wiki/serve...t_firewall_ssh
    But when I enabled ufw, I noticed all those intimidating rules that are enabled by default. So I was thinking that the people who created ufw are more knowledgeable than me and created all those rules for a reasons. Thus I gave up the iptables route and concentrated on ufw.

    I then started the following tutorial (already mentioned above):
    http://linux.overshoot.tv/wiki/serve...cated_firewall
    but got stuck at the point where I asked the questions above.

    And I still haven't got a firewall yet, because I am still trying to understand the logic.

    If iptables rules do not by themselves constitute a firewall, how do we know whether any firewall is running or not?

  6. #6
    Join Date
    Nov 2009
    Location
    Mataro, Spain
    Beans
    14,013
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: ufw: remote set up of first firewall

    This is one of my threads but it has other questions about ufw first. The questions about iptables and examples how to do it are towards page 3 and later.
    http://ubuntuforums.org/showthread.php?t=1947308

    The way I understand it, and I might be wrong, is that iptables rules do constitute a firewall but it's not working when ufw is disabled. Somehow.

    Is this firewall intended to protect this machine, or another one?

    If you need it to protect this machine, regardless whether you use iptables directly or ufw, you better configure the INPUT and FORWARD chains to DROP, and the OUTPUT to ACCEPT. Then you can only open what you need.

    But doing everything remotely is a bit complicated. Before setting INPUT to DROP you have to make sure you configure rule(s) to let you access by SSH. If you lock yourself out I don't see another way except someone physically logging into the machine and disabling your firewall to let you in.

    I did my firewall with ufw, but if I knew what I know now, I would have done it with iptables and the setup in /etc/network/interfaces as discussed in my thread I linked above.

    The main thing I don't like about ufw, and I realized too late, is that if you have a syntax error in a rule in /etc/ufw/before.rules for example, it will not apply any of the rules in the file. That way it can lock you out if it doesn't apply the rule letting you in.

    What I also noticed is that ufw is not always flushing iptables correctly. So, when you do ufw disable && ufw enable, it can create double entries with time.

    Using a file with your iptables rules and doing the iptables-restore procedure is better I think. Even if you have syntax error in one rule, it just ignores that one. Unless I am wrong. I can't test now. Maybe later in vitrual box.
    Darko.
    -----------------------------------------------------------------------
    Ubuntu 14.04 LTS 64bit & Windows 10 Pro 64bit

  7. #7
    Join Date
    Jun 2011
    Location
    The Shadow Gallery
    Beans
    6,782

    Re: ufw: remote set up of first firewall

    see here for instructions on setting up a firewall in Ubuntu.

    http://ubuntuforums.org/showthread.php?t=1876124

    IPTables is the firewall regardless of what front end you use, UFW/GUFW etc are merely configuration front ends to manipulate IPTables rules.

    Also if you lock yourself out from a remote connection then the only method of cirumventing that is to visit the machine physically

    Peace
    Feel Free to Bitcoin Tip: 135Rp4pwwYTHEJ4u8bxKaDQiC91N9LUoV2

    Backtrack - Giving machine guns to monkeys since 2006
    Kali-Linux - Adding a grenade launcher to the machine guns since 2013

  8. #8
    Join Date
    Nov 2009
    Location
    Mataro, Spain
    Beans
    14,013
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: ufw: remote set up of first firewall

    For example, a simple way to activate iptables is to create a file /etc/iptables.rules for example. Note that you need to create it with sudo, for example if using nano editor:
    sudo nano /etc/iptables.rules

    The content might be:
    Code:
    *filter
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT ACCEPT [0:0]
    
    -A INPUT -p tcp --dport 22 -j ACCEPT
    
    COMMIT
    That will configure a DROP in both INPUT and FORWARD chains, and ACCEPT in the OUTPUT chain which is sort of a default config. It will also add a rule to allow SSH connections on port 22 to prevent you locking yourself when activating the rules.

    Change the port if you use different port for SSH. You can also limit it to accept SSH connections only from specific IP address (if you have a static public IP in your home/office and you want to prevent anyone trying to break into your server). And they will try, especially if you leave the port as 22. In that case the modified line would be like:
    -A INPUT -p tcp -s <public IP> --dport 22 -j ACCEPT

    You can activate the rules you saved in /etc/iptables.rules by:
    sudo iptables-restore < /etc/iptables.rules

    You can add a command to do this automatically at boot as it was discussed in the thread I linked earlier. Note that this way the rules are always flushed and only the rules specified in your file are activated. Also the counters are reset. If you want the counters to be saved and to continue counting, I think you need to add -c to the iptables-restore.
    Darko.
    -----------------------------------------------------------------------
    Ubuntu 14.04 LTS 64bit & Windows 10 Pro 64bit

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •