The sys admin's daily grind: UFW

Lack of Defense

Article from Issue 171/2015

Things were better back then. No way! Charly takes a look back at the bad old firewall days and explains why things are better today – assuming you have the right tools.

Watch out, Granddaddy Charly is about to tell his old war stories again: We had nothing back then. If you were in firewall support, that meant working on the front, in your underwear, at temperatures of minus 20 degrees. And, we used to have to build firewall rulesets using BSD's built-in IPFW tool, which didn't even have stateful packet inspection at the time. People kept locking themselves out of the command center or shooting themselves in the foot.

IPWF led to ipchains, which was a blessing; it was followed in kernel 2.4 by iptables, on which most of today's Linux firewalls are based – although the designated successor, nftables, went missing in action some time ago.

However, you can't teach the troops iptables in five minutes – not even the basic routines, such as allow all outgoing, block all incoming, except for connections on ports 22, 80, and 443. Uncomplicated Firewall [1], UFW is actually a much better choice for building just-so firewalls.

Originally developed for Ubuntu, UFW is now included with most Debian-based distributions and Arch Linux. If you built your house on some other underpinnings, you can still download the tarball [1] and run the usual installer suspects.

You just need two commands to set the default rules:

sudo ufw default deny incoming
sudo ufw default allow outgoing

The following allows external access to the SSH and web services:

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

The service names are as defined in /etc/services. Of course, this would work with the port numbers, too (i.e., with 22/tcp instead of ssh).

Service Is Service, Normally

Using sudo ufw enable enables the rules, and you can check this by typing sudo ufw status verbose. But, what if you use Mosh instead of SSH? Mosh needs access to UDP ports 60000 through 61000. You can handle this in UFW with the following command:

sudo ufw allow 60000:61000/udp

UFW, however, offers an even easier approach. It comes with shortcuts for individual services; you can type ufw app list to list them. To my delight, my buddy Mosh is on the list. To give Mosh the run of the root, I just type:

sudo ufw allow mosh

Just to check, I type sudo ufw status verbose again; you can see the results in Figure 1. UFW has enabled all the rules for both IPv4 and IPv6; good thinking! You can manage this behavior in the /etc/default/ufw file's IPV6 = Yes line. Additionally, if you want to remove a rule on the fly, you can do so with the delete keyword, as in:

sudo ufw delete allow mosh
Figure 1: After a few lines of configuration, the UFW firewall already gives me some protection against attacks.

Granddaddy Charly would have really appreciated this kind of defense back when he was manning a rusty old IPFW bazooka.

The Author

Charly Kühnast is a Unix operating system administrator at the Data Center in Moers, Germany. His tasks include firewall and DMZ security and availability. He divides his leisure time into hot, wet, and eastern sectors, where he enjoys cooking, freshwater aquariums, and learning Japanese, respectively.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Charly's Column: Mosh

    Dangling your legs in the sea while enjoying the Mediterranean sunshine can affect the prospect of a good Internet connection; fortunately, Charly knows what to do.

  • Charly's Column: Trickle

    If your data traffic suffers from congestion at times, don't worry. Now you can shoot down programs that are heavy on traffic to free up the inflow and outflow.

  • Charly's Column – Let's Encrypt

    Columnist Charly fights the fight for free SSL certificates with Let's Encrypt. He particularly likes the matching software client that takes care of everything – from certificate retrieval to web server integration.

  • The sys admin's daily grind: sshuttle

    When he doesn't want to deal with OpenVPN version conflicts or congestion control problems during TCP tunneling, Charly catches a ride on sshuttle.

  • Charly's Birds

    Charly ran a first-generation Rasp Pi for years in the birdhouse in his garden, but the Rasp Pi eventually fell foul of marauding wasps. Now Charly has replaced it with an RPi3 featuring a NoIR cam and motion detection.

comments powered by Disqus