The sys admin's daily grind: UFW
Lack of Defense

Things were better back then. No way! Charly takes a look back at the bad old firewall days and explains why things are better today – assuming you have the right tools.
Watch out, Granddaddy Charly is about to tell his old war stories again: We had nothing back then. If you were in firewall support, that meant working on the front, in your underwear, at temperatures of minus 20 degrees. And, we used to have to build firewall rulesets using BSD's built-in IPFW tool, which didn't even have stateful packet inspection at the time. People kept locking themselves out of the command center or shooting themselves in the foot.
IPWF led to ipchains, which was a blessing; it was followed in kernel 2.4 by iptables, on which most of today's Linux firewalls are based – although the designated successor, nftables, went missing in action some time ago.
However, you can't teach the troops iptables in five minutes – not even the basic routines, such as allow all outgoing, block all incoming, except for connections on ports 22, 80, and 443. Uncomplicated Firewall [1], UFW is actually a much better choice for building just-so firewalls.
Originally developed for Ubuntu, UFW is now included with most Debian-based distributions and Arch Linux. If you built your house on some other underpinnings, you can still download the tarball [1] and run the usual installer suspects.
You just need two commands to set the default rules:
sudo ufw default deny incoming sudo ufw default allow outgoing
The following allows external access to the SSH and web services:
sudo ufw allow ssh sudo ufw allow http sudo ufw allow https
The service names are as defined in /etc/services
. Of course, this would work with the port numbers, too (i.e., with 22/tcp
instead of ssh
).
Service Is Service, Normally
Using sudo ufw enable
enables the rules, and you can check this by typing sudo ufw status verbose
. But, what if you use Mosh instead of SSH? Mosh needs access to UDP ports 60000 through 61000. You can handle this in UFW with the following command:
sudo ufw allow 60000:61000/udp
UFW, however, offers an even easier approach. It comes with shortcuts for individual services; you can type ufw app list
to list them. To my delight, my buddy Mosh is on the list. To give Mosh the run of the root, I just type:
sudo ufw allow mosh
Just to check, I type sudo ufw status verbose
again; you can see the results in Figure 1. UFW has enabled all the rules for both IPv4 and IPv6; good thinking! You can manage this behavior in the /etc/default/ufw
file's IPV6 = Yes
line. Additionally, if you want to remove a rule on the fly, you can do so with the delete
keyword, as in:
sudo ufw delete allow mosh

Granddaddy Charly would have really appreciated this kind of defense back when he was manning a rusty old IPFW bazooka.
Infos
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
2024 Open Source Professionals Job Survey Now Open
Share your expectations regarding open source jobs.
-
Arch Linux 2023.12.01 Released with a Much-Improved Installer
If you've ever wanted to install Arch Linux, now is your time. With the latest release, the archinstall script vastly simplifies the process.
-
Zorin OS 17 Beta Available for Testing
The upcoming version of Zorin OS includes plenty of improvements to take your PC to a whole new level of user-friendliness.
-
Red Hat Migrates RHEL from Xorg to Wayland
If you've been wondering when Xorg will finally be a thing of the past, wonder no more, as Red Hat has made it clear.
-
PipeWire 1.0 Officially Released
PipeWire was created to take the place of the oft-troubled PulseAudio and has finally reached the 1.0 status as a major update with plenty of improvements and the usual bug fixes.
-
Rocky Linux 9.3 Available for Download
The latest version of the RHEL alternative is now available and brings back cloud and container images for ppc64le along with plenty of new features and fixes.
-
Ubuntu Budgie Shifts How to Tackle Wayland
Ubuntu Budgie has yet to make the switch to Wayland but with a change in approaches, they're finally on track to making it happen.
-
TUXEDO's New Ultraportable Linux Workstation Released
The TUXEDO Pulse 14 blends portability with power, thanks to the AMD Ryzen 7 7840HS CPU.
-
AlmaLinux Will No Longer Be "Just Another RHEL Clone"
With the release of AlmaLinux 9.3, the distribution will be built entirely from upstream sources.
-
elementary OS 8 Has a Big Surprise in Store
When elementary OS 8 finally arrives, it will not only be based on Ubuntu 24.04 but it will also default to Wayland for better performance and security.