From b6f142c6feb5209ee34b203679aa430d2003e080 Mon Sep 17 00:00:00 2001 From: Luke Smith Date: Thu, 1 Jul 2021 16:55:22 -0400 Subject: ufw tweaks --- ufw.html | 79 +++++++++++++++++++++++++++++++++------------------------------- 1 file changed, 41 insertions(+), 38 deletions(-) (limited to 'ufw.html') diff --git a/ufw.html b/ufw.html index 2f33047..b036242 100644 --- a/ufw.html +++ b/ufw.html @@ -17,33 +17,22 @@ We can use ufw to restrict machines on the internet to only access the services (SSH, websites etc) you want them to, but it can also be used to prevent programs on the computer itself from accesing parts of the internet it shouldn't.

-

- If you're reading this, I'll assume you have set up a server on Vultr. -

-

How to Get It

Log into your server by pulling up a terminal and typing:

- 
ssh root@yourdomain.com
+ 
ssh root@example.org

This command will attempt to log into your server and run a remote shell. If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site. - If you did not set up your DNS yet, replace yourdomain.com with the IP address that Vultr gives you.

- If you followed setting up your webserver, then you know that Vultr already installed ufw for you. - If you don't use Vultr, then you can install it on a Debian system by running in your remote shell: + Some VPS providers automatically install ufw, but if you do not have it installed already, install it in the typical way:

- 
apt-get update && apt-get install ufw
- -

- The first command checks to see what packages can be installed, and the second command installs ufw. - It's strung together by a && to run the second command as long as the first succeeded. -

+ 
apt install ufw

First-Time Setup

@@ -56,7 +45,6 @@ 
ufw default deny incoming # block all incoming connections by default
@@ -96,19 +84,6 @@ To                           Action      From
 		
ufw delete allow in 'WWW Full'
 ufw reload

 
-		
Recovering SSH

-
-		

-			If you have accidentally firewalled yourself from logging on your computer, you can recover access by using Vultr's console.
-			Looking at your server in the Vultr menu, you should see a meatball menu on the right which gives you access to a console.
-		

-
-		View Console
-
-		
Log in through there, and disable ufw by typing:

-
-		
ufw disable

-
 		
Enabling Common Services

 
 		

@@ -117,10 +92,31 @@ ufw reload
Here is a list of a few common services:

+

Opening Port Numbers

+ +

Suppose you install a Gemini server, which must broadcast on port 1965. By default ufw blocks all incoming connections on all ports, so whenever you install a new service like this you will have to tell ufw to enable the desired port:

+ + 
ufw allow 1985
+

Websites: HTTP and HTTPS

- 
ufw allow in 'WWW Full'
-ufw reload
+

HTTP uses port 80 and HTTPS uses port 443. We can enable them like this:

+ + 
ufw allow 80
+ufw allow 443
+ +

But ufw additionally knows the typical ports of common serives, so you can also run this:

+ + 
ufw allow http
+ufw allow https
+ +

And that will do the same thing. There are also other abbreviations for common port lists:

+ + 
ufw allow in 'WWW Full'
+ + +

To see these other "apps" that ufw knows by default, run ufw app list

+

Email: IMAP, POP3, and SMTP

@@ -128,14 +124,7 @@ ufw reload ufw allow in POP3 ufw allow in SMTP ufw allow in 'Postfix SMTPS' -ufw allow in 'Mail Submission' -ufw reload - -

Everything Else

- -

You can view all applications ufw knows about by running:

- - 
ufw app list
+ufw allow in 'Mail Submission'

Fine-Tuning Rules

@@ -175,6 +164,20 @@ ufw status verbose 
man ufw
+

Recovering SSH

+ +

+ If you have accidentally firewalled yourself from logging on your computer, you can recover access by using your VPS's virtual console. + On Vultr, this is on your VPS's menu. To the right of the server name, It is the leftmost icon that looks like a monitor. +

+ + View Console + +

Log in through there, and disable ufw by typing:

+ + 
ufw disable
+ +

Further Reading