mirror of
https://github.com/mikaela/mikaela.github.io/
synced 2024-11-23 04:29:31 +01:00
95 lines
4.1 KiB
Markdown
95 lines
4.1 KiB
Markdown
---
|
|
layout: post
|
|
comments: true
|
|
title: "My ufw (Ubuntu/Uncomplicated Firewall) config"
|
|
category: [english]
|
|
tags: [english]
|
|
redirect_from: /ufw/
|
|
---
|
|
|
|
*This post describes my UFW config and is here so I find it from somewhere
|
|
and with hope that I am told if someone notices something terriby insecure
|
|
here and is able to offer suggestions. This probably will never be
|
|
perfect.*
|
|
|
|
Having firewall is important as you aren't always in your trusted home
|
|
network (that can also be broken into especially if you have WLAN) and
|
|
with IPv6 your devices have public IPv6 addresses. Theoretically your
|
|
router should include a firewall, but at least the Huawei mobile broadband
|
|
routers or MiFis don't include one (and I might be annoyed by it enough
|
|
to disable it anyway and configure everything on host level if it was
|
|
my network).
|
|
|
|
*Threat model: service I am not aware of or that I accidentally make
|
|
listen wider than intended, with UFW I am aware of what ports are
|
|
allowed. I assume any mobile host is going to move randomly and while
|
|
some whitelists (especially link-local and IPv4 LANs) will overlap and
|
|
possibly allow access, it's still better than being open to the internet
|
|
and overlay networks that I have interacted with recently.*
|
|
|
|
This post first has list of commands, then explanations that won't be
|
|
repeated with IPvX ranges.
|
|
|
|
```bash
|
|
ufw allow 22/tcp
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
systemctl enable ufw && systemctl start ufw
|
|
ufw enable
|
|
ufw reject 113/tcp
|
|
#ufw allow from 192.168.8.0/24 to any port 631 proto tcp
|
|
ufw allow from fe80::/10 to any port 631
|
|
#ufw allow from 192.168.8.0/24 to any port 5353 proto udp
|
|
ufw allow from fe80::/10 to any port 5353 proto udp
|
|
#ufw allow from <static:Yggdrasil:IPv6> to any port 5900
|
|
ufw allow from fe80::/10 to any port 9001 proto udp
|
|
ufw allow 60000:61000/udp
|
|
```
|
|
|
|
* 22 TCP/ssh — Allow acces to SSHd you don't want to lock yourself out.
|
|
* previously I used `ufw limit` but it seems to be too oversensitive,
|
|
just use SSHGuard.
|
|
* Deny incoming connections unless the port has been whitelisted.
|
|
* Allow all outgoing connections, keeping list of authorized ports would
|
|
be too much for me.
|
|
* Start ufw on boot and now (I am not sure if this step is required, but
|
|
better safe than sorry).
|
|
* Put the firewall in force.
|
|
* 113 TCP/ident — Tell "Connection refused" to whoever tries to reach port
|
|
113. This makes ident checking IRC servers connect faster as they don't
|
|
have to timeout. If you run shell server (for IRC purpouses) you should
|
|
allow this instead. And if you don't use IRC or don't care about having
|
|
to wait for the check to timeout, don't do this as you may leave
|
|
yourself visible to random port scanners.
|
|
* 631 both/cups — Allow access to cups for printer sharing from 192.168.8.xxx
|
|
* fe80:://10 is link-local address existing _everywhere_ IPv6 is enabled,
|
|
check your `ip addr` or on Windows `ipconfig /all` for fun.
|
|
* 5353 UDP/mdns/Avahi — used for `.local` addresses.
|
|
* 5900 — VNC port at least for `krfb kdrc` (KDE Remote Desktop server & client).
|
|
I tend to only allow it from specific Yggdrasil address(es).
|
|
* 9001/udp — [Yggdrasil](https://yggdrasil-network.github.io/) automatic
|
|
peering port only on link-local.
|
|
* 60000:61000 UDP/mosh — I feel this is the most insecure part of this
|
|
setup and there should be something bettter instead of this. As
|
|
something evil could run and listen on these ports.
|
|
|
|
*If some host doesn't run some of the mentioned service, it's not open in
|
|
the firewall.*
|
|
|
|
KDE Connect which seems painful enough to list separately and doesn't seem
|
|
to work IPv6-only or I am too impatient.
|
|
|
|
|
|
```bash
|
|
#ufw allow from 192.168.8.0/24 to any port 1714:1764 proto tcp
|
|
#ufw allow from 192.168.8.0/24 to any port 1714:1764 proto udp
|
|
ufw allow from fe80::/10 to any port 1714:1764 proto tcp
|
|
ufw allow from fe80::/10 to any port 1714:1764 proto udp
|
|
```
|
|
|
|
|
|
* * * * *
|
|
|
|
Last updated: 2018-11-03T13:25+0200 | [GitHub changelog](https://github.com/Mikaela/mikaela.github.io/commits/master/_posts/2015-06-12-ufw.md) |
|
|
[Blesmrt Gitea changelog](https://gitea.blesmrt.net/mikaela/mikaela-info/commits/branch/master/_posts/2015-06-12-ufw.md)
|