From ad271f9d55546b00dffd0149f9161a17fffb9231 Mon Sep 17 00:00:00 2001 From: Samuel Hunter Date: Wed, 30 Jun 2021 20:09:56 -0700 Subject: Add UFW Tutorial --- ufw.html | 173 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 173 insertions(+) create mode 100644 ufw.html (limited to 'ufw.html') diff --git a/ufw.html b/ufw.html new file mode 100644 index 0000000..7f80f08 --- /dev/null +++ b/ufw.html @@ -0,0 +1,173 @@ + + + + Using UFW as a Firewall – LandChad.net + + + + + + + +

Using UFW as a Firewall

+ +
+

+ Uncomplicated Firewall (UFW) is a front-facing program for the more involved iptables firewall program installed in most GNU/Linux distributions. + If you're reading this, I assume you know the basic steps on how to use a Linux shell and how to install software for your server. + Otherwise, I recommend following Setting Up a Web Server. +

+ +

How to Get It

+ +

+ If you followed the basic setup course, then you know that Vultr already installed ufw for you. + If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: +

+ + 
sudo apt-get update && sudo apt-get install ufw
+ +

+ The first command checks to see what packages can be installed, and the second command installs ufw. + It's strung together by a && to run the second command as long as the first succeeded. +

+ +

First-Time Setup

+ +

+ ufw is an administration program, so you will need root access to use it. + To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: +

+ + 
sudo su -
+ +

I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

+ +

You can check the status of ufw right now by running:

+ + 
ufw status
+ +

Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

+ + + + 
ufw default deny incoming # block all incoming connections by default
+ufw allow in ssh # or: ufw allow in 22
+ufw enable
+ + + +

+ With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + To view all your rules, run: +

+ + 
ufw status verbose
+ +

A firewall that allows to connect to SSH and their website may look like:

+ + 
Status: active
+Logging: on (low)
+Default: deny (incoming), allow (outgoing), deny (routed)
+New profiles: skip
+
+To                           Action      From
+--                           ------      ----
+22 (SSH)                     ALLOW IN    Anywhere
+80,443/tcp (WWW Full)        ALLOW IN    Anywhere
+22 (SSH (v6))                ALLOW IN    Anywhere (v6)
+80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)
+ +

If you want to delete e.g. the 'WWW Full' rule, run:

+ + 
ufw delete allow in 'WWW Full'
+ufw reload
+ +

Enabling Common Services

+ +

+ You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. + You should look at the ports your services are open on and enable them individually. + Here is a list of a few common services: +

+ +

Websites: HTTP and HTTPS

+ + 
ufw allow in 'WWW Full'
+ufw reload
+ +

Email: IMAP, POP3, and SMTP

+ + 
ufw allow in IMAPS
+ufw allow in POP3
+ufw allow in SMTP
+ufw allow in 'Postfix SMTPS'
+ufw allow in 'Mail Submission'
+ufw reload
+ +

Everything Else

+ +

You can view all applications ufw knows about by running:

+ + 
ufw app list
+ +

Fine-Tuning Rules

+ +

Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

+ + 
ufw default allow in
+ufw deny in PORT
+ufw reject in PORT
+ufw reload
+ +

You can add rules to comments to remember what they are there for:

+ + 
ufw allow in PORT comment 'Secret SSH'
+ufw reload
+ufw status verbose
+ +

Output:

+ + 
To                         Action      From
+--                         ------      ----
+PORT                       ALLOW IN    Anywhere                   # Secret SSH
+PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH
+ +

To deny outgoing ports:

+ + 
ufw deny out PORT
+ +

Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

+ + 
ufw limit PORT/tcp
+ +

To blocklist IP addresses:

+ + 
ufw deny from IP_ADDRESS
+ +

To read more what you can do with ufw, run:

+ + 
man ufw
+ +

Further Reading

+ + + + Contributor - shunter.xyz +
+ + + -- cgit v1.2.3