1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
|
<!DOCTYPE html>
<html lang=en>
<head>
<title>Using UFW as a Firewall – LandChad.net</title>
<meta charset="utf-8"/>
<link rel="shortcut icon" href="favicon.ico" type="image/x-icon" />
<link rel='stylesheet' type='text/css' href='style.css'>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'>
</head>
<body>
<header><h1>Using UFW as a Firewall</h1></header>
<nav></nav>
<main>
<p>
<strong>Uncomplicated Firewall</strong> (UFW) is a front-facing program for the more involved <code>iptables</code> firewall program installed in most GNU/Linux distributions.
We can use <code>ufw</code> to restrict machines on the internet to only access the services (SSH, websites etc) you want them to, but it can also be used to prevent programs on the computer itself from accesing parts of the internet it shouldn't.
</p>
<p>
If you're reading this, I'll assume you have <a href="server.html">set up a server on Vultr</a>.
</p>
<h2 id="how-to-get-it">How to Get It</h2>
<p>Log into your server by pulling up a terminal and typing:</p>
<pre><code>ssh root@<strong>yourdomain.com</strong></code></pre>
<p>
This command will attempt to log into your server and run a remote shell.
If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site.
If you did not <a href="dns.html">set up your DNS yet</a>, replace <code><strong>yourdomain.com</strong></code> with the IP address that Vultr gives you.
</p>
<p>
If you followed <a href="nginx.html#firewall">setting up your webserver</a>, then you know that Vultr already installed <code>ufw</code> for you.
If you don't use Vultr, then you can install it on a Debian system by running in your remote shell:
</p>
<pre><code>apt-get update && apt-get install ufw</code></pre>
<p>
The first command checks to see what packages can be installed, and the second command installs <code>ufw</code>.
It's strung together by a <code>&&</code> to run the second command as long as the first succeeded.
</p>
<h2 id="first-time-setup">First-Time Setup</h2>
<p>You can check the status of <code>ufw</code> right now by running:</p>
<pre><code>ufw status</code></pre>
<p>Without any changes, it should report back <code>Status: inactive</code>. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:</p>
<aside>
<strong>Careful!</strong> Enabling <code>ufw</code> without allowing SSH will block you from remoting to your server.
Double-check that you have allowed SSH, and if you have changed the default SSH port, put in <em>that</em> number instead.
And then double-check again.
</aside>
<pre><code>ufw default deny incoming # block all incoming connections by default
ufw allow in ssh # or: ufw allow in 22
ufw enable</code></pre>
<aside>
<code>ufw</code> has an internal list of protocols applications, and the ports used by them.
In this case, it knwos SSH is on port 22.
We'll go more in detail how to view all protocols <code>ufw</code> knows about.
By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6.
</aside>
<p>
With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests.
To view all your rules, run:
</p>
<pre><code>ufw status verbose</code></pre>
<p>A firewall that allows to connect to SSH and their website may look like:</p>
<pre><code>Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
22 (SSH) ALLOW IN Anywhere
80,443/tcp (WWW Full) ALLOW IN Anywhere
22 (SSH (v6)) ALLOW IN Anywhere (v6)
80,443/tcp (WWW Full (v6)) ALLOW IN Anywhere (v6)</code></pre>
<p>If you want to delete e.g. the 'WWW Full' rule, run:</p>
<pre><code>ufw delete allow in 'WWW Full'
ufw reload</pre></code>
<h2 id="enabling-common-services">Enabling Common Services</h2>
<p>
You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website.
You should look at the ports your services are open on and enable them individually.
Here is a list of a few common services:
</p>
<h3>Websites: HTTP and HTTPS</h3>
<pre><code>ufw allow in 'WWW Full'
ufw reload</code></pre>
<h3>Email: IMAP, POP3, and SMTP</h3>
<pre><code>ufw allow in IMAPS
ufw allow in POP3
ufw allow in SMTP
ufw allow in 'Postfix SMTPS'
ufw allow in 'Mail Submission'
ufw reload</pre></code>
<h3>Everything Else</h3>
<p>You can view all applications <code>ufw</code> knows about by running:</p>
<pre><code>ufw app list</code></pre>
<h2 id="fine-tuning-rules">Fine-Tuning Rules</h2>
<p>Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):</p>
<pre><code>ufw default allow in
ufw deny in <strong>PORT</strong>
ufw reject in <strong>PORT</strong>
ufw reload</code></pre>
<p>You can add rules to comments to remember what they are there for:</p>
<pre><code>ufw allow in <strong>PORT</strong> comment 'Secret SSH'
ufw reload
ufw status verbose</code></pre>
<p>Output:</p>
<pre><code>To Action From
-- ------ ----
<strong>PORT</strong> ALLOW IN Anywhere # Secret SSH
<strong>PORT</strong> (v6) ALLOW IN Anywhere (v6) # Secret SSH</pre></code>
<p>To deny outgoing ports:</p>
<pre><code>ufw deny out <strong>PORT</strong></code></pre>
<p>Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:</p>
<pre><code>ufw limit <strong>PORT</strong>/tcp</code></pre>
<p>To blocklist IP addresses:</p>
<pre><code>ufw deny from <strong>IP_ADDRESS</strong></code></pre>
<p>To read more what you can do with <code>ufw</code>, run:</p>
<pre><code>man ufw</code></pre>
<h2 id="further-reading">Further Reading</h2>
<ul>
<li><a href="https://wiki.ubuntu.com/UncomplicatedFirewall">Ubuntu Wiki: UncomplicatedFirewall</a></li>
<li><a href="https://help.ubuntu.com/community/Gufw">Gufw (Graphical UFW)</a></li>
<li><code>man ufw</code></li>
</ul>
<strong>Contributor</strong> - <a href="https://shunter.xyz">shunter.xyz</a>
</main>
<footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer>
</body>
</html>
|
