Using UFW as a Firewall

+ Uncomplicated Firewall (UFW) is a front-facing program for the more involved iptables firewall program installed in most GNU/Linux distributions. + If you're reading this, I assume you know the basic steps on how to use a Linux shell and how to install software for your server. + Otherwise, I recommend following Setting Up a Web Server. +

+ +

How to Get It

+ +

+ If you followed the basic setup course, then you know that Vultr already installed ufw for you. + If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: +

+ +

sudo apt-get update && sudo apt-get install ufw

+ +

+ The first command checks to see what packages can be installed, and the second command installs ufw. + It's strung together by a && to run the second command as long as the first succeeded. +

+ +

First-Time Setup

+ +

+ ufw is an administration program, so you will need root access to use it. + To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: +

+ +

sudo su -

+ +

I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

+ +

You can check the status of ufw right now by running:

+ +

ufw status

+ +

Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

+ +

+ Careful! Enabling ufw without allowing SSH will block you from remoting to your server. + Double-check that you have allowed SSH, and if you have changed the default SSH port, put in that number instead. + And then double-check again. +

+ +

ufw default deny incoming # block all incoming connections by default
+ufw allow in ssh # or: ufw allow in 22
+ufw enable

+ +

+ ufw has an internal list of protocols applications, and the ports used by them. + In this case, it knwos SSH is on port 22. + We'll go more in detail how to view all protocols ufw knows about. + By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6. +

+ +

+ With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + To view all your rules, run: +

+ +

ufw status verbose

+ +

A firewall that allows to connect to SSH and their website may look like:

+ +

Status: active
+Logging: on (low)
+Default: deny (incoming), allow (outgoing), deny (routed)
+New profiles: skip
+
+To                           Action      From
+--                           ------      ----
+22 (SSH)                     ALLOW IN    Anywhere
+80,443/tcp (WWW Full)        ALLOW IN    Anywhere
+22 (SSH (v6))                ALLOW IN    Anywhere (v6)
+80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)

+ +

If you want to delete e.g. the 'WWW Full' rule, run:

+ +

ufw delete allow in 'WWW Full'
+ufw reload

+ +

Enabling Common Services

+ +

+ You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. + You should look at the ports your services are open on and enable them individually. + Here is a list of a few common services: +

+ +

Websites: HTTP and HTTPS

+ +

ufw allow in 'WWW Full'
+ufw reload

+ +

Email: IMAP, POP3, and SMTP

+ +

ufw allow in IMAPS
+ufw allow in POP3
+ufw allow in SMTP
+ufw allow in 'Postfix SMTPS'
+ufw allow in 'Mail Submission'
+ufw reload

+ +

Everything Else

+ +

You can view all applications ufw knows about by running:

+ +

ufw app list

+ +

Fine-Tuning Rules

+ +

Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

+ +

ufw default allow in
+ufw deny in PORT
+ufw reject in PORT
+ufw reload

+ +

You can add rules to comments to remember what they are there for:

+ +

ufw allow in PORT comment 'Secret SSH'
+ufw reload
+ufw status verbose

+ +

Output:

+ +

To                         Action      From
+--                         ------      ----
+PORT                       ALLOW IN    Anywhere                   # Secret SSH
+PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH

+ +

To deny outgoing ports:

+ +

ufw deny out PORT

+ +

Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

+ +

ufw limit PORT/tcp

+ +

To blocklist IP addresses:

+ +

ufw deny from IP_ADDRESS

+ +

To read more what you can do with ufw, run:

+ +

man ufw

+ +

How to Get It

Log into your server by pulling up a terminal and typing:

+ +

ssh root@yourdomain.com

- If you followed the basic setup course, then you know that Vultr already installed ufw for you. - If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: + This command will attempt to log into your server and run a remote shell. + If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site. + If you did not set up your DNS yet, replace yourdomain.com with the IP address that Vultr gives you.

sudo apt-get update && sudo apt-get install ufw

- The first command checks to see what packages can be installed, and the second command installs ufw. - It's strung together by a && to run the second command as long as the first succeeded. + If you followed setting up your webserver, then you know that Vultr already installed ufw for you. + If you don't use Vultr, then you can install it on a Debian system by running in your remote shell:

First-Time Setup

apt-get update && apt-get install ufw

- ufw is an administration program, so you will need root access to use it. - To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: + The first command checks to see what packages can be installed, and the second command installs ufw. + It's strung together by a && to run the second command as long as the first succeeded.

sudo su -

- -

I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

First-Time Setup

You can check the status of ufw right now by running:

-- cgit v1.2.3 From 09e8d8df7a96cae0b9b12af236a7f6958e79fe70 Mon Sep 17 00:00:00 2001 From: Samuel Hunter Date: Wed, 30 Jun 2021 21:54:15 -0700 Subject: UFW: Add SSH recovery section --- pix/view-console.png | Bin 0 -> 32884 bytes ufw.html | 15 ++++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 pix/view-console.png diff --git a/pix/view-console.png b/pix/view-console.png new file mode 100644 index 0000000..f37d96d Binary files /dev/null and b/pix/view-console.png differ diff --git a/ufw.html b/ufw.html index 85cd439..2f33047 100644 --- a/ufw.html +++ b/ufw.html @@ -56,7 +56,7 @@

Careful! Enabling ufw without allowing SSH will block you from remoting to your server. Double-check that you have allowed SSH, and if you have changed the default SSH port, put in that number instead. - And then double-check again. + If you have been blocked from SSH, we will get to how to use Vultr's console to recover from it.

ufw default deny incoming # block all incoming connections by default
@@ -96,6 +96,19 @@ To                           Action      From
 		ufw delete allow in 'WWW Full'
 ufw reload
 
+		Recovering SSH
+
+		
+			If you have accidentally firewalled yourself from logging on your computer, you can recover access by using Vultr's console.
+			Looking at your server in the Vultr menu, you should see a meatball menu on the right which gives you access to a console.
+		
+
+		
+
+		Log in through there, and disable ufw by typing:
+
+		ufw disable
+
 		Enabling Common Services
 
 		
-- 
cgit v1.2.3


From b6f142c6feb5209ee34b203679aa430d2003e080 Mon Sep 17 00:00:00 2001
From: Luke Smith 
Date: Thu, 1 Jul 2021 16:55:22 -0400
Subject: ufw tweaks

---
 pix/view-console.png | Bin 32884 -> 0 bytes
 ufw.html             |  79 ++++++++++++++++++++++++++-------------------------
 2 files changed, 41 insertions(+), 38 deletions(-)
 delete mode 100644 pix/view-console.png

diff --git a/pix/view-console.png b/pix/view-console.png
deleted file mode 100644
index f37d96d..0000000
Binary files a/pix/view-console.png and /dev/null differ
diff --git a/ufw.html b/ufw.html
index 2f33047..b036242 100644
--- a/ufw.html
+++ b/ufw.html
@@ -17,33 +17,22 @@
 			We can use ufw to restrict machines on the internet to only access the services (SSH, websites etc) you want them to, but it can also be used to prevent programs on the computer itself from accesing parts of the internet it shouldn't.
 		
 
-		
-			If you're reading this, I'll assume you have set up a server on Vultr.
-		
-
 		How to Get It
 
 		Log into your server by pulling up a terminal and typing:
 
-		ssh root@yourdomain.com
+		ssh root@example.org
 
 		
 			This command will attempt to log into your server and run a remote shell.
 			If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site.
-			If you did not set up your DNS yet, replace yourdomain.com with the IP address that Vultr gives you.
 		
 
 		
-			If you followed setting up your webserver, then you know that Vultr already installed ufw for you.
-			If you don't use Vultr, then you can install it on a Debian system by running in your remote shell:
+        Some VPS providers automatically install ufw, but if you do not have it installed already, install it in the typical way:
 		
 
-		apt-get update && apt-get install ufw
-
-		
-			The first command checks to see what packages can be installed, and the second command installs ufw.
-			It's strung together by a && to run the second command as long as the first succeeded.
-		
+		apt install ufw
 
 		First-Time Setup
 
@@ -56,7 +45,6 @@
 		
 			Careful! Enabling ufw without allowing SSH will block you from remoting to your server.
 			Double-check that you have allowed SSH, and if you have changed the default SSH port, put in that number instead.
-			If you have been blocked from SSH, we will get to how to use Vultr's console to recover from it.
 		
 
 		ufw default deny incoming # block all incoming connections by default
@@ -96,19 +84,6 @@ To                           Action      From
 		ufw delete allow in 'WWW Full'
 ufw reload
 
-		Recovering SSH
-
-		
-			If you have accidentally firewalled yourself from logging on your computer, you can recover access by using Vultr's console.
-			Looking at your server in the Vultr menu, you should see a meatball menu on the right which gives you access to a console.
-		
-
-		
-
-		Log in through there, and disable ufw by typing:
-
-		ufw disable
-
 		Enabling Common Services
 
 		
@@ -117,10 +92,31 @@ ufw reload
 			Here is a list of a few common services:
 		
 
+        Opening Port Numbers
+
+        Suppose you install a Gemini server, which must broadcast on port 1965. By default ufw blocks all incoming connections on all ports, so whenever you install a new service like this you will have to tell ufw to enable the desired port:
+
+        ufw allow 1985
+
 		Websites: HTTP and HTTPS
 
-		ufw allow in 'WWW Full'
-ufw reload
+        HTTP uses port 80 and HTTPS uses port 443. We can enable them like this:
+
+        ufw allow 80
+ufw allow 443
+
+        But ufw additionally knows the typical ports of common serives, so you can also run this:
+
+        ufw allow http
+ufw allow https
+
+        And that will do the same thing. There are also other abbreviations for common port lists:
+
+		ufw allow in 'WWW Full'
+
+
+        To see these other "apps" that ufw knows by default, run ufw app list
+
 
 		Email: IMAP, POP3, and SMTP
 
@@ -128,14 +124,7 @@ ufw reload

ufw allow in POP3 ufw allow in SMTP ufw allow in 'Postfix SMTPS' -ufw allow in 'Mail Submission' -ufw reload - -

Everything Else

- -

You can view all applications ufw knows about by running:

- -

ufw app list

+ufw allow in 'Mail Submission'

Fine-Tuning Rules

@@ -175,6 +164,20 @@ ufw status verbose

man ufw

Recovering SSH

+ +

+ If you have accidentally firewalled yourself from logging on your computer, you can recover access by using your VPS's virtual console. + On Vultr, this is on your VPS's menu. To the right of the server name, It is the leftmost icon that looks like a monitor. +

+ +

+ +

ufw disable

+ +

"Build your own platform!"

The Firewall

The Firewall

Using UFW as a Firewall

How to Get It

First-Time Setup

Enabling Common Services

Websites: HTTP and HTTPS

Email: IMAP, POP3, and SMTP

Everything Else

Fine-Tuning Rules

Further Reading

How to Get It

First-Time Setup

First-Time Setup

Recovering SSH

Enabling Common Services

How to Get It

First-Time Setup

Recovering SSH

Enabling Common Services

Opening Port Numbers

Websites: HTTP and HTTPS

Email: IMAP, POP3, and SMTP

Everything Else

Fine-Tuning Rules

Recovering SSH

Further Reading