mikaela.github.io/_posts/2015-06-12-ufw.md

57 lines
2.1 KiB
Markdown
Raw Normal View History

2015-06-12 18:06:17 +02:00
---
layout: post
comments: true
title: "My ufw (Ubuntu/Uncomplicated Firewall) config"
category: [english]
tags: [english]
redirect_from: /ufw/
---
*This post describes my UFW config and is here so I find it from somewhere
and with hope that I am told if someone notices something terriby insecure
here and is able to offer suggestions.*
Having firewall is important as you aren't always in your trusted home
network and with IPv6 your devices have public IPv6 addresses.
This post first has list of commands, then explanations.
```
ufw limit 22
ufw default deny incoming
ufw default allow outgoing
systemctl enable ufw && systemctl start ufw
ufw enable
2015-07-09 14:59:11 +02:00
ufw reject 113
ufw allow from 172.16.0.0/16 to any port 631
ufw allow from 172.16.0.0/16 to any port 5353
2015-08-22 11:07:14 +02:00
ufw allow from 172.16.0.0/16 to any port 9091
ufw allow from 172.16.0.0/16 to any port 17500 proto tcp
2015-06-12 18:06:17 +02:00
ufw allow 60000:61000/udp
```
* 22/ssh — Prevent more than 6 connections in 30 seconds to the SSH port
and it's the first command as you don't want to lock yourself out of
your host when you enable the firewall.
* Deny incoming connections unless the port has been whitelisted.
* Allow all outgoing connections, keeping list of authorized ports would be
too much for me.
* Start ufw on boot and now (I am not sure if this step is required, but
better safe than sorry).
* Put the firewall in force.
2015-07-09 14:59:11 +02:00
* 113/ident — Tell "Connection refused" to whoever tries to reach port 113.
This makes ident checking IRC servers connect faster as they don't have
to timeout. If you run shell server (for IRC purpouses) you should allow
this instead.
* 631/cups — Allow access to cups for printer sharing from local network
* 5353/mdns/Avahi — used for `.local` addresses and probably not needed
outside local network
2015-08-22 11:07:14 +02:00
* 9091/transmission web interface — also something I want to access from
LAN.
2015-06-12 18:06:17 +02:00
* 17500/Dropbox — which I use everywhere
* 60000:61000/mosh — I feel this is the most insecure part of this setup
and there should be something bettter instead of this.
*If some host doesn't run some of the mentioned service, it's not open in
the firewall.*