content/blog/2021-01-07-ufw.org

  1#+date:        <2021-01-07 Thu 00:00:00>
  2#+title:       Configuring Uncomplicated Firewall (ufw) on Ubuntu Servers
  3#+description: Stepwise instructions for installation, configuration, enabling, and management of the Uncomplicated Firewall utility to secure network interfaces on Ubuntu server environments.
  4#+slug:        ufw
  5#+filetags:    :firewall:security:ufw:
  6
  7* Uncomplicated Firewall
  8
  9Uncomplicated Firewall, also known as ufw, is a convenient and
 10beginner-friendly way to enforce OS-level firewall rules. For those who
 11are hosting servers or any device that is accessible to the world (i.e.,
 12by public IP or domain name), it's critical that a firewall is properly
 13implemented and active.
 14
 15Ufw is available by default in all Ubuntu installations after 8.04 LTS.
 16For other distributions, you can look to install ufw or check if there
 17are alternative firewalls installed already. There are usually
 18alternatives available, such as Fedora's =firewall= and the package
 19available on most distributions: =iptables=. Ufw is considered a
 20beginner-friendly front-end to iptables.
 21
 22[[https://gufw.org][Gufw]] is available as a graphical user interface
 23(GUI) application for users who are uncomfortable setting up a firewall
 24through a terminal.
 25
 26* Getting Help
 27
 28If you need help figuring out commands, remember that you can run the
 29=--help= flag to get a list of options.
 30
 31#+begin_src sh
 32sudo ufw --help
 33#+end_src
 34
 35* Set Default State
 36
 37The proper way to run a firewall is to set a strict default state and
 38slowly open up ports that you want to allow. This helps prevent anything
 39malicious from slipping through the cracks. The following command
 40prevents all incoming traffic (other than the rules we specify later),
 41but you can also set this for outgoing connections, if necessary.
 42
 43#+begin_src sh
 44sudo ufw default deny incoming
 45#+end_src
 46
 47You should also allow outgoing traffic if you want to allow the device
 48to communicate back to you or other parties. For example, media servers
 49like Plex need to be able to send out data related to streaming the
 50media.
 51
 52#+begin_src sh
 53sudo ufw default allow outgoing
 54#+end_src
 55
 56* Adding Port Rules
 57
 58Now that we've disabled all incoming traffic by default, we need to open
 59up some ports (or else no traffic would be able to come in). If you need
 60to be able to =ssh= into the machine, you'll need to open up port 22.
 61
 62#+begin_src sh
 63sudo ufw allow 22
 64#+end_src
 65
 66You can also issue more restrictive rules. The following rule will allow
 67=ssh= connections only from machines on the local subnet.
 68
 69#+begin_src sh
 70sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22
 71#+end_src
 72
 73If you need to set a rule that isn't tcp, just append your connection
 74type to the end of the rule.
 75
 76#+begin_src sh
 77sudo ufw allow 1900/udp
 78#+end_src
 79
 80* Enable ufw
 81
 82Now that the firewall is configured and ready to go, you can enable the
 83firewall.
 84
 85#+begin_src sh
 86sudo ufw enable
 87#+end_src
 88
 89A restart may be required for the firewall to begin operating.
 90
 91#+begin_src sh
 92sudo reboot now
 93#+end_src
 94
 95* Checking Status
 96
 97Now that the firewall is enabled, let's check and see what the rules
 98look like.
 99
100#+begin_src sh
101sudo ufw status numbered
102#+end_src
103
104#+begin_src txt
105Status: active
106
107     To                    Action      From
108     --                    ------      ----
109[ 1] 22                    ALLOW IN    Anywhere
110[ 2] 22 (v6)               ALLOW IN    Anywhere (v6)
111#+end_src
112
113* Deleting Rules
114
115If you need to delete a rule, you need to know the number associated
116with that rule. Let's delete the first rule in the table above. You'll
117be asked to confirm the deletion as part of this process.
118
119#+begin_src sh
120sudo ufw delete 1
121#+end_src
122
123* Managing App Rules
124
125Luckily, there's a convenient way for installed applications to create
126files that ufw can easily implement so that you don't have to search and
127find which ports your application requires. To see if your device has
128any applications with pre-installed ufw rules, execute the following
129command:
130
131#+begin_src sh
132sudo ufw app list
133#+end_src
134
135The results should look something like this:
136
137#+begin_src txt
138Available applications:
139    OpenSSH
140    Samba
141    plexmediaserver
142    plexmediaserver-all
143    plexmediaserver-dlna
144#+end_src
145
146If you want to get more information on a specific app rule, use the
147=info= command.
148
149#+begin_src sh
150sudo ufw app info plexmediaserver-dlna
151#+end_src
152
153You'll get a blurb of info back like this:
154
155#+begin_src txt
156Profile: plexmediaserver-dlna
157Title: Plex Media Server (DLNA)
158Description: The Plex Media Server (additional DLNA capability only)
159
160Ports:
161    1900/udp
162    32469/tcp
163#+end_src
164
165You can add or delete app rules the same way that you'd add or delete
166specific port rules.
167
168#+begin_src sh
169sudo ufw allow plexmediaserver-dlna
170#+end_src
171
172#+begin_src sh
173sudo ufw delete RULE|NUM
174#+end_src
175
176* Creating App Rules
177
178If you'd like to create you own app rule, you'll need to create a file
179in the =/etc/ufw/applications.d= directory. Within the file you create,
180you need to make sure the content is properly formatted.
181
182For example, here are the contents my =plexmediaserver= file, which
183creates three distinct app rules for ufw:
184
185#+begin_src config
186[plexmediaserver]
187title=Plex Media Server (Standard)
188description=The Plex Media Server
189ports=32400/tcp|3005/tcp|5353/udp|8324/tcp|32410:32414/udp
190
191[plexmediaserver-dlna]
192title=Plex Media Server (DLNA)
193description=The Plex Media Server (additional DLNA capability only)
194ports=1900/udp|32469/tcp
195
196[plexmediaserver-all]
197title=Plex Media Server (Standard + DLNA)
198description=The Plex Media Server (with additional DLNA capability)
199ports=32400/tcp|3005/tcp|5353/udp|8324/tcp|32410:32414/udp|1900/udp|32469/tcp
200#+end_src
201
202So, if I wanted to create a custom app rule called "mycustomrule," I'd
203create a file and add my content like this:
204
205#+begin_src sh
206sudo nano /etc/ufw/applications.d/mycustomrule
207#+end_src
208
209#+begin_src config
210[mycustomrule]
211title=My Custom Rule
212description=This is a temporary ufw app rule.
213ports=88/tcp|9100/udp
214#+end_src
215
216Then, I would just enable this rule in ufw.
217
218#+begin_src sh
219sudo ufw allow mycustomrule
220#+end_src