mikaela.github.io/_posts/2015-06-12-ufw.md
Mikaela Suomalainen 7952fcf0cc
ufw: transmission uses UDP for DHT
Both are the same port number and this would be nice to be documented
somewhere.
2017-06-04 12:20:45 +03:00

67 lines
2.7 KiB
Markdown

---
layout: post
comments: true
title: "My ufw (Ubuntu/Uncomplicated Firewall) config"
category: [english]
tags: [english]
redirect_from: /ufw/
---
*This post describes my UFW config and is here so I find it from somewhere
and with hope that I am told if someone notices something terriby insecure
here and is able to offer suggestions.*
Having firewall is important as you aren't always in your trusted home
network and with IPv6 your devices have public IPv6 addresses.
*Threat model: service I am not aware of or that I accidentally make
listen wider than intended and with UFW I am aware of what ports are
allowed. I assume any host is going to move randomly and not
whitelisting only from certain addresses as that address can be
encountered anywhere.*
This post first has list of commands, then explanations.
```
ufw allow 22/tcp
ufw default deny incoming
ufw default allow outgoing
systemctl enable ufw && systemctl start ufw
ufw enable
ufw reject 113/tcp
ufw allow 631
ufw allow 5353/udp
ufw allow from 172.16.0.0/16 to any port 9091 proto tcp
ufw allow 60000:61000/udp
```
* 22 TCP/ssh — Allow acces to SSHd you don't want to lock yourself out.
* previously I used `ufw limit` but it seems to be too oversensitive,
just use SSHGuard.
* Deny incoming connections unless the port has been whitelisted.
* Allow all outgoing connections, keeping list of authorized ports would
be too much for me.
* Start ufw on boot and now (I am not sure if this step is required, but
better safe than sorry).
* Put the firewall in force.
* 113 TCP/ident — Tell "Connection refused" to whoever tries to reach port
113. This makes ident checking IRC servers connect faster as they don't
have to timeout. If you run shell server (for IRC purpouses) you should
allow this instead. And if you don't use IRC or don't care about having
to wait for the check to timeout, don't do this as you may leave
yourself visible to random port scanners.
* 631 both/cups — Allow access to cups for printer sharing.
* 5353 UDP/mdns/Avahi — used for `.local` addresses.
* 9091 TCP/transmission web interface and also example on how to allow
access to port only from specific addresses, only for devices that
aren't going anywhere and if IPv6 isn't cared about. (TODO: How to do
it IPv6? I have faint idea of UFW not supporting it).
* Transmission file transfer uses TCP and DHT UDP. Default port for
both is: 51413. [Source](https://trac.transmissionbt.com/ticket/2265)
* 60000:61000 UDP/mosh — I feel this is the most insecure part of this
setup and there should be something bettter instead of this. As
something evil could run and listen on these ports.
*If some host doesn't run some of the mentioned service, it's not open in
the firewall.*