|
Size: 1456
Comment:
|
Size: 1475
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| = UFW = | = Ufw = |
| Line 3: | Line 3: |
| '''Uncomplicated Firewall''' ('''UFW''') is a simple-to-use but powerful firewall management software. It is a wrapper around `iptables`, automatically writing rules for it. | '''`ufw(8)`''' ('''U'''ncomplicated '''F'''ire'''w'''all) is a firewall management program. It is a wrapper around `iptables(8)`. |
| Line 5: | Line 5: |
| UFW is accessed through the `ufw` executable, which on many distributions is installed to `/usr/sbin`--only the root user will have this program on their path. The associated `systemd` service file is `ufw.service`. | <<TableOfContents>> |
| Line 11: | Line 11: |
| == Basic Setup == | == Installation == |
| Line 13: | Line 13: |
| This is more than sufficient for servers that are not meant to be web-facing. | Install the `ufw` package through your preferred package manager. Then [[Linux/Systemd|start and enable]] ufw.service. |
| Line 15: | Line 15: |
| {{{ ufw default deny incoming ufw default allow outgoing ufw allow ssh ufw allow 22 }}} If using custom ports, adjust as needed. This would be set in `/etc/ssh/sshd_config`. |
Note that not all operating systems have strong support for `ufw(8)`. [[Linux/Alpine|Alpine Linux]] prefers its users to use [[Awall]]; [[Linux/Fedora|Fedora]] and associated projects ship with the incompatible [[Linux/SystemdFirewalld|firewalld]]. [[BSD|BSDs]] do not offer `iptables(8)`, so `ufw(8)` is a non-option. |
| Line 29: | Line 21: |
| == HTTP == | == Configuration == |
| Line 31: | Line 23: |
| Regardless of `httpd` flavor (Apache, NGINX, lighttpd, etc), this basic configuration should suffice. First the unencrypted port, then the encrypted port. | A basic rule set is: {{{ ufw default deny incoming ufw default allow outgoing ufw allow 22 }}} `ufw(8)` is distributed with '''app profiles''' that simplify the configuration process. Instead of allowing ''ports'', consider allowing ''apps''. {{{ ufw allow ssh }}} === Web Servers === The following rules should allow any web server to operate. |
| Line 35: | Line 45: |
| ufw allow 80 | |
| Line 37: | Line 46: |
| ufw allow 443 | |
| Line 40: | Line 48: |
| If using custom ports, adjust as needed. ---- |
Additional steps may be required if using [[Encryption/Certbot|certbot]] on a custom port. |
| Line 46: | Line 52: |
| == FTP == First the unencrypted port, then the encrypted (FTPS, '''not''' SFTP) port. |
=== FTP === |
| Line 57: | Line 61: |
| Passive configuration also utilizes a pool of ports. This is an example--'''''not''''' recommended--configuration for `vsftpd`. | Passive configuration also utilizes a pool of ports. Recommended to use custom ports, so adjust as needed. |
| Line 63: | Line 67: |
| Recommended to use custom ports, so adjust as needed. |
Ufw
ufw(8) (Uncomplicated Firewall) is a firewall management program. It is a wrapper around iptables(8).
Contents
Installation
Install the ufw package through your preferred package manager. Then start and enable ufw.service.
Note that not all operating systems have strong support for ufw(8). Alpine Linux prefers its users to use Awall; Fedora and associated projects ship with the incompatible firewalld. BSDs do not offer iptables(8), so ufw(8) is a non-option.
Configuration
A basic rule set is:
ufw default deny incoming ufw default allow outgoing ufw allow 22
ufw(8) is distributed with app profiles that simplify the configuration process. Instead of allowing ports, consider allowing apps.
ufw allow ssh
Web Servers
The following rules should allow any web server to operate.
ufw allow http ufw allow https
Additional steps may be required if using certbot on a custom port.
FTP
ufw allow 20/tcp ufw allow 21/tcp ufw allow 989/tcp ufw allow 990/tcp
Passive configuration also utilizes a pool of ports. Recommended to use custom ports, so adjust as needed.
ufw allow 40000:42000/tcp