Using UFW as a Firewall

+ Uncomplicated Firewall (UFW) is a front-facing program for the more involved iptables firewall program installed in most GNU/Linux distributions. + If you're reading this, I assume you know the basic steps on how to use a Linux shell and how to install software for your server. + Otherwise, I recommend following Setting Up a Web Server. +

+ +

How to Get It

+ +

+ If you followed the basic setup course, then you know that Vultr already installed ufw for you. + If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: +

+ +

sudo apt-get update && sudo apt-get install ufw

+ +

+ The first command checks to see what packages can be installed, and the second command installs ufw. + It's strung together by a && to run the second command as long as the first succeeded. +

+ +

First-Time Setup

+ +

+ ufw is an administration program, so you will need root access to use it. + To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: +

+ +

sudo su -

+ +

I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

+ +

You can check the status of ufw right now by running:

+ +

ufw status

+ +

Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

+ +

+ Careful! Enabling ufw without allowing SSH will block you from remoting to your server. + Double-check that you have allowed SSH, and if you have changed the default SSH port, put in that number instead. + And then double-check again. +

+ +

ufw default deny incoming # block all incoming connections by default
+ufw allow in ssh # or: ufw allow in 22
+ufw enable

+ +

+ ufw has an internal list of protocols applications, and the ports used by them. + In this case, it knwos SSH is on port 22. + We'll go more in detail how to view all protocols ufw knows about. + By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6. +

+ +

+ With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + To view all your rules, run: +

+ +

ufw status verbose

+ +

A firewall that allows to connect to SSH and their website may look like:

+ +

Status: active
+Logging: on (low)
+Default: deny (incoming), allow (outgoing), deny (routed)
+New profiles: skip
+
+To                           Action      From
+--                           ------      ----
+22 (SSH)                     ALLOW IN    Anywhere
+80,443/tcp (WWW Full)        ALLOW IN    Anywhere
+22 (SSH (v6))                ALLOW IN    Anywhere (v6)
+80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)

+ +

If you want to delete e.g. the 'WWW Full' rule, run:

+ +

ufw delete allow in 'WWW Full'
+ufw reload

+ +

Enabling Common Services

+ +

+ You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. + You should look at the ports your services are open on and enable them individually. + Here is a list of a few common services: +

+ +

Websites: HTTP and HTTPS

+ +

ufw allow in 'WWW Full'
+ufw reload

+ +

Email: IMAP, POP3, and SMTP

+ +

ufw allow in IMAPS
+ufw allow in POP3
+ufw allow in SMTP
+ufw allow in 'Postfix SMTPS'
+ufw allow in 'Mail Submission'
+ufw reload

+ +

Everything Else

+ +

You can view all applications ufw knows about by running:

+ +

ufw app list

+ +

Fine-Tuning Rules

+ +

Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

+ +

ufw default allow in
+ufw deny in PORT
+ufw reject in PORT
+ufw reload

+ +

You can add rules to comments to remember what they are there for:

+ +

ufw allow in PORT comment 'Secret SSH'
+ufw reload
+ufw status verbose

+ +

Output:

+ +

To                         Action      From
+--                         ------      ----
+PORT                       ALLOW IN    Anywhere                   # Secret SSH
+PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH

+ +

To deny outgoing ports:

+ +

ufw deny out PORT

+ +

Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

+ +

ufw limit PORT/tcp

+ +

To blocklist IP addresses:

+ +

ufw deny from IP_ADDRESS

+ +

To read more what you can do with ufw, run:

+ +

man ufw

+ +

How to Get It

Log into your server by pulling up a terminal and typing:

+ +

ssh root@yourdomain.com

- If you followed the basic setup course, then you know that Vultr already installed ufw for you. - If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: + This command will attempt to log into your server and run a remote shell. + If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site. + If you did not set up your DNS yet, replace yourdomain.com with the IP address that Vultr gives you.

sudo apt-get update && sudo apt-get install ufw

- The first command checks to see what packages can be installed, and the second command installs ufw. - It's strung together by a && to run the second command as long as the first succeeded. + If you followed setting up your webserver, then you know that Vultr already installed ufw for you. + If you don't use Vultr, then you can install it on a Debian system by running in your remote shell:

First-Time Setup

apt-get update && apt-get install ufw

- ufw is an administration program, so you will need root access to use it. - To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: + The first command checks to see what packages can be installed, and the second command installs ufw. + It's strung together by a && to run the second command as long as the first succeeded.

sudo su -

- -

I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

First-Time Setup

You can check the status of ufw right now by running:

-- cgit v1.2.3 From 09e8d8df7a96cae0b9b12af236a7f6958e79fe70 Mon Sep 17 00:00:00 2001 From: Samuel Hunter Date: Wed, 30 Jun 2021 21:54:15 -0700 Subject: UFW: Add SSH recovery section --- pix/view-console.png | Bin 0 -> 32884 bytes ufw.html | 15 ++++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 pix/view-console.png (limited to 'ufw.html') diff --git a/pix/view-console.png b/pix/view-console.png new file mode 100644 index 0000000..f37d96d Binary files /dev/null and b/pix/view-console.png differ diff --git a/ufw.html b/ufw.html index 85cd439..2f33047 100644 --- a/ufw.html +++ b/ufw.html @@ -56,7 +56,7 @@

Careful! Enabling ufw without allowing SSH will block you from remoting to your server. Double-check that you have allowed SSH, and if you have changed the default SSH port, put in that number instead. - And then double-check again. + If you have been blocked from SSH, we will get to how to use Vultr's console to recover from it.

ufw default deny incoming # block all incoming connections by default
@@ -96,6 +96,19 @@ To                           Action      From
 		ufw delete allow in 'WWW Full'
 ufw reload
 
+		Recovering SSH
+
+		
+			If you have accidentally firewalled yourself from logging on your computer, you can recover access by using Vultr's console.
+			Looking at your server in the Vultr menu, you should see a meatball menu on the right which gives you access to a console.
+		
+
+		
+
+		Log in through there, and disable ufw by typing:
+
+		ufw disable
+
 		Enabling Common Services
 
 		
-- 
cgit v1.2.3

How to Get It

First-Time Setup

Enabling Common Services

Websites: HTTP and HTTPS

Email: IMAP, POP3, and SMTP

Everything Else

Fine-Tuning Rules

Further Reading

How to Get It

First-Time Setup

First-Time Setup

Recovering SSH

Enabling Common Services