cmc/cleberg.net

  1#+date:        [2021-01-07 Thu 00:00:00]
  2#+title:       UFW: Firewall Setup on Ubuntu
  3#+description: How to install and configure UFW on Ubuntu.
  4#+slug:        ufw
  5#+filetags:    :linux:security:
  6
  7* Uncomplicated Firewall
  8
  9Uncomplicated Firewall (UFW) is a convenient and beginner-friendly
 10way to enforce operating system (OS)-level firewall rules. For those who are
 11hosting servers or any device that is accessible to the world (i.e., by public
 12IP or domain name), it's critical that a firewall is properly implemented and
 13active.
 14
 15UFW is available by default in all Ubuntu installations after 8.04 LTS
 16(long-term support). For other distributions, you can look to install UFW or
 17check if there are alternative firewalls installed already. There are usually
 18alternatives available, such as Fedora's =firewall= and the package available on
 19most distributions: =iptables=. UFW is considered a beginner-friendly front-end
 20to iptables.
 21
 22[[https://gufw.org][Gufw]] is available as a graphical user interface (GUI) application for users who
 23are uncomfortable setting up a firewall through a terminal.
 24
 25* Getting Help
 26
 27If you need help figuring out commands, remember that you can run the
 28=--help= flag to get a list of options.
 29
 30#+begin_src sh
 31sudo ufw --help
 32#+end_src
 33
 34* Set Default State
 35
 36The proper way to run a firewall is to set a strict default state and slowly
 37open up ports that you want to allow. This helps prevent anything malicious from
 38slipping through the cracks. The following command prevents all incoming traffic
 39(other than the rules we specify later), but you can also set this for outgoing
 40connections, if necessary.
 41
 42#+begin_src sh
 43sudo ufw default deny incoming
 44#+end_src
 45
 46You should also allow outgoing traffic if you want to allow the device to
 47communicate back to you or other parties. For example, media servers like Plex
 48need to be able to send out data related to streaming the media.
 49
 50#+begin_src sh
 51sudo ufw default allow outgoing
 52#+end_src
 53
 54* Adding Port Rules
 55
 56Now that we've disabled all incoming traffic by default, we need to open up some
 57ports (or else no traffic would be able to come in). If you need to be able to
 58=ssh= into the machine, you'll need to open up port 22.
 59
 60#+begin_src sh
 61sudo ufw allow 22
 62#+end_src
 63
 64You can also issue more restrictive rules. The following rule will allow =ssh=
 65(secure shell protocol) connections only from machines on the local subnet.
 66
 67#+begin_src sh
 68sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22
 69#+end_src
 70
 71If you need to set a rule that isn't TCP (Transmission Control Protocol) just
 72append your connection type to the end of the rule.
 73
 74#+begin_src sh
 75sudo ufw allow 1900/udp
 76#+end_src
 77
 78* Enable ufw
 79
 80Now that the firewall is configured and ready to go, you can enable the
 81firewall.
 82
 83#+begin_src sh
 84sudo ufw enable
 85#+end_src
 86
 87A restart may be required for the firewall to begin operating.
 88
 89#+begin_src sh
 90sudo reboot now
 91#+end_src
 92
 93* Checking Status
 94
 95Now that the firewall is enabled, let's check and see what the rules look like.
 96
 97#+begin_src sh
 98sudo ufw status numbered
 99#+end_src
100
101#+begin_src txt
102Status: active
103
104     To                    Action      From
105     --                    ------      ----
106[ 1] 22                    ALLOW IN    Anywhere
107[ 2] 22 (v6)               ALLOW IN    Anywhere (v6)
108#+end_src
109
110* Deleting Rules
111
112If you need to delete a rule, you need to know the number associated with that
113rule. Let's delete the first rule in the table above. You'll be asked to confirm
114the deletion as part of this process.
115
116#+begin_src sh
117sudo ufw delete 1
118#+end_src
119
120* Managing App Rules
121
122Luckily, there's a convenient way for installed applications to create files
123that ufw can easily implement so that you don't have to search and find which
124ports your application requires. To see if your device has any applications with
125pre-installed UFW rules, execute the following command:
126
127#+begin_src sh
128sudo ufw app list
129#+end_src
130
131The results should look something like this:
132
133#+begin_src txt
134Available applications:
135    OpenSSH
136    Samba
137    plexmediaserver
138    plexmediaserver-all
139    plexmediaserver-dlna
140#+end_src
141
142If you want to get more information on a specific app rule, use the =info=
143command.
144
145#+begin_src sh
146sudo ufw app info plexmediaserver-dlna
147#+end_src
148
149You'll get a blurb of info back like this:
150
151#+begin_src txt
152Profile: plexmediaserver-dlna
153Title: Plex Media Server (DLNA)
154Description: The Plex Media Server (additional DLNA capability only)
155
156Ports:
157    1900/udp
158    32469/tcp
159#+end_src
160
161You can add or delete app rules the same way that you'd add or delete specific
162port rules.
163
164#+begin_src sh
165sudo ufw allow plexmediaserver-dlna
166#+end_src
167
168#+begin_src sh
169sudo ufw delete RULE|NUM
170#+end_src
171
172* Creating App Rules
173
174If you'd like to create you own app rule, you'll need to create a file in the
175=/etc/ufw/applications.d= directory. Within the file you create, you need to
176make sure the content is properly formatted.
177
178For example, here are the contents my =plexmediaserver= file, which creates
179three distinct app rules for ufw:
180
181#+begin_src config
182[plexmediaserver]
183title=Plex Media Server (Standard)
184description=The Plex Media Server
185ports=32400/tcp|3005/tcp|5353/udp|8324/tcp|32410:32414/udp
186
187[plexmediaserver-dlna]
188title=Plex Media Server (DLNA)
189description=The Plex Media Server (additional DLNA capability only)
190ports=1900/udp|32469/tcp
191
192[plexmediaserver-all]
193title=Plex Media Server (Standard + DLNA)
194description=The Plex Media Server (with additional DLNA capability)
195ports=32400/tcp|3005/tcp|5353/udp|8324/tcp|32410:32414/udp|1900/udp|32469/tcp
196#+end_src
197
198So, if I wanted to create a custom app rule called "mycustomrule," I'd create a
199file and add my content like this:
200
201#+begin_src sh
202sudo nano /etc/ufw/applications.d/mycustomrule
203#+end_src
204
205#+begin_src config
206[mycustomrule]
207title=My Custom Rule
208description=This is a temporary ufw app rule.
209ports=88/tcp|9100/udp
210#+end_src
211
212Then, I would just enable this rule in ufw.
213
214#+begin_src sh
215sudo ufw allow mycustomrule
216#+end_src