{"id":37,"date":"2019-02-03T17:03:00","date_gmt":"2019-02-03T17:03:00","guid":{"rendered":"https:\/\/hostup.org\/blog\/?p=37"},"modified":"2024-04-03T12:55:00","modified_gmt":"2024-04-03T12:55:00","slug":"more-in-depth-configuration-of-ubuntu-firewall-ufw","status":"publish","type":"post","link":"https:\/\/hostup.se\/en\/blog\/more-in-depth-configuration-of-ubuntu-firewall-ufw\/","title":{"rendered":"More in Depth Configuration of Ubuntu Firewall (UFW)"},"content":{"rendered":"\n

Hi there again! In this tutorial, I am going to move in depth cover how to configure UFW (UncomplicatedFirewall<\/a> ). If you have already installed UFW, then you can skip the first section.<\/p>\n\n\n\n

This is tested to work with Ubuntu 16.04-18.04, although it may work on other versions too!
<\/p>\n\n\n\n

Installation of UFW and Basic Information<\/h2>\n\n\n\n

You can check if you already have installed the firewall by running:<\/p>\n\n\n\n

which ufw<\/code><\/pre>\n\n\n\n
If it outputs \/usr\/sbin\/ufw<\/strong> then it is already installed, if not run the following:<\/p>\n\n\n\n
sudo apt-get install ufw<\/code> <\/pre>\n\n\n\n
You can view the status of your firewall by running<\/p>\n\n\n\n
sudo ufw status<\/code> <\/pre>\n\n\n\n
It will output either status: inactive<\/strong> or status: active<\/strong><\/p>\n\n\n\n
To start the firewall again you simply need to send the following command:<\/p>\n\n\n\n
sudo service ufw start<\/code> <\/pre>\n\n\n\n
To stop your Ubuntu firewall:<\/p>\n\n\n\n
sudo service ufw stop<\/pre>\n\n\n\n
Allow Connections<\/h2>\n\n\n\n
When you want to allow connections you simply typesudo ufw allow<\/strong><\/code> , followed with the port OR program you wish to allow. An example of this is SSH.<\/p>\n\n\n\n
sudo ufw allow ssh\/tcp <\/pre>\n\n\n\n
Or you can allow it using the port.<\/p>\n\n\n\n
sudo ufw allow 22\/tcp  <\/pre>\n\n\n\n
Below you can find a list of the most common ports, the source is utilizewindow.<\/p>\n\n\n\n
Port<\/th>Service name<\/th>Transport protocol<\/th><\/tr>
 20, 21<\/td> File Transfer Protocol (FTP)<\/td> TCP<\/td><\/tr>
 22<\/td> Secure Shell (SSH)<\/td> TCP and UDP<\/td><\/tr>
 23<\/td> Telnet<\/td> TCP<\/td><\/tr>
 25<\/td> Simple Mail Transfer Protocol (SMTP)<\/td> TCP<\/td><\/tr>
 50, 51<\/td> IPSec<\/td><\/tr>
 53<\/td> Domain Name System (DNS)<\/td> TCP and UDP<\/td><\/tr>
 67, 68<\/td> Dynamic Host Configuration Protocol (DHCP)<\/td> UDP<\/td><\/tr>
 69<\/td> Trivial File Transfer Protocol (TFTP)<\/td> UDP<\/td><\/tr>
 80<\/td> HyperText Transfer Protocol (HTTP)<\/td> TCP<\/td><\/tr>
 110<\/td> Post Office Protocol (POP3)<\/td> TCP<\/td><\/tr>
 119<\/td> Network News Transport Protocol (NNTP)<\/td> TCP<\/td><\/tr>
 123<\/td> Network Time Protocol (NTP)<\/td> UDP<\/td><\/tr>
 135-139<\/td> NetBIOS<\/td> TCP and UDP<\/td><\/tr>
 143<\/td> Internet Message Access Protocol (IMAP4)<\/td> TCP and UDP<\/td><\/tr>
 161, 162<\/td> Simple Network Management Protocol (SNMP)<\/td> TCP and UDP<\/td><\/tr>
 389<\/td> Lightweight Directory Access Protocol<\/td> TCP and UDP<\/td><\/tr>
 443<\/td> HTTPs Secure Sockets Layer (SSL)<\/td> TCP and UDP<\/td><\/tr>
 3389<\/td> Remote Desktop Protocol<\/td> TCP and UDP<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
So let us say we want to enable HTTP. We can see in the list above that port 80 has protocol name HTTP. To allow this we need to do the same thing as we did above. Example:<\/p>\n\n\n\n
sudo ufw allow HTTP\/tcp<\/pre>\n\n\n\n
OR<\/p>\n\n\n\n
 sudo ufw allow 80\/tcp <\/pre>\n\n\n\n
A general equation for this would be sudo ufw allow (SERVICENAME\/PORT)\/(TRANSPORT PROTOCOL)<\/strong><\/code>. You can also find what transport protocol you should use in the list above. <\/p>\n\n\n\n
Block Connections<\/h2>\n\n\n\n
When you want to block connections you simply typesudo ufw deny<\/strong><\/code>, followed with the port or program you wish to block, just as shown above.<\/p>\n\n\n\n
If you want to block a specific IP:<\/p>\n\n\n\n
sudo ufw deny from 88.88.88.88<\/code><\/pre>\n\n\n\n
Just remember to replace 88.88.88.88<\/strong><\/code> With the IP address of your choice. You can also block a whole subnet:<\/p>\n\n\n\n
sudo ufw deny from 88.88.88.0\/24<\/code> <\/pre>\n\n\n\n
Rate limiting with UFW<\/h2>\n\n\n\n
Another good feature to include is rate limiting. This would make it so if an IP address has attempted to initiate >6 connections within the last 30 seconds it would be blocked temporarily. This can be very useful for SSH as it makes brute-forcing almost impossible. <\/p>\n\n\n\n
ufw limit ssh<\/pre>\n\n\n\n
Or limiting by port:<\/p>\n\n\n\n
ufw limit 22<\/pre>\n\n\n\n
You can change the service ssh<\/strong> or 22 <\/strong>to the service you want to limit.<\/p>\n\n\n\n
Setting up the Host Firewall to Protect Against Internal Threats<\/h2>\n\n\n\n
If you are not behind a properly setup hardware firewall, you may solve this by software configurations by setting the default_output_policy=drop<\/strong> to control all box i\/o. <\/p>\n\n\n\n
This assumes you’re on a 10.x.x.x<\/strong> network and during setup, you only need yourself to be able to access the box via ssh. Change 10.x.x.x<\/strong>  to suit your config as shown below.<\/p>\n\n\n\n
Open the configuration file by running:<\/p>\n\n\n\n
sudo nano \/etc\/default\/ufw<\/code><\/pre>\n\n\n\n
Make sure that Your default output policy is set to drop, like this: DEFAULT_OUTPUT_POLICY=\"DROP\"<\/strong><\/code> <\/p>\n\n\n\n
Save by pressing  CTRL<\/bawt-key> + X<\/bawt-key> and follow the instructions prompted on the screen.<\/p>\n\n\n\n
Back at the terminal run the following commands:<\/p>\n\n\n\n
sudo ufw allow proto tcp from 10.x.x.x to any port 22<\/code>
sudo ufw enable<\/code>
sudo service ufw start<\/code>
sudo ufw logging medium<\/code><\/pre>\n\n\n\n
Make sure to change 10.x.x.x<\/strong> <\/code>to your own IP address or domain name.
<\/p>\n\n\n\n
If you don’t already have a VPS, or want to reward us for hard work and ad free experience you can buy a VPS<\/a> from us. We would really appreciate it as we don’t have any donation buttons and this is our only source of income. Our VPSes are located in Stockholm, and we even have a Swedish branded site <\/a>if you’re from Sweden.<\/p>\n","protected":false},"excerpt":{"rendered":"
Hi there again! In this tutorial, I am going to move in depth cover how to configure UFW (UncomplicatedFirewall ). If you have already installed UFW, then you can skip the first section. This is tested to work with Ubuntu 16.04-18.04, although it may work on other versions too! Installation of UFW and Basic Information […]<\/p>\n","protected":false},"author":1,"featured_media":157,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,17],"tags":[],"class_list":["post-37","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","category-linux"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts\/37","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/comments?post=37"}],"version-history":[{"count":3,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts\/37\/revisions"}],"predecessor-version":[{"id":418,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts\/37\/revisions\/418"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/media\/157"}],"wp:attachment":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/media?parent=37"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/categories?post=37"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/tags?post=37"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}