ufw
The imRAD system uses "ufw" as a default firewall configuration.[1] UFW is a front-end for iptables and is particularly well-suited for host-based firewalls. Users can therefore configure the firewall to allow certain types of network traffic to pass into and out of a system (for instance SSH or web server traffic). This is done by opening and closing TCP and UDP "ports" in the firewall. Additionally, firewalls can be configured to allow or restrict access to specific IP addresses (or IP address ranges).[2]
You can enable or disable using the ufw enable or ufw disable command in the configuration mode.
The status of ufw is initially in disable. Therefore, you may enable it if necessary.
We introduce basic syntax and examples. For more details, Please visit the https://help.ubuntu.com/community/UFW. or http://manpages.ubuntu.com/manpages/bionic/man8/ufw.8.html.
Verifying ufw
LYSH@MyHostName# show ufw Status: inactive // ufw is in disable
The following example is a typical configuration when ufw is in enable. The default "incoming" rule is "deny". It means that all traffic will be denied except for the allowed rules.
LYSH@MyHostName# show ufw Status: active // ufw is in enable Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10 [ 2] 22 ALLOW IN 192.168.0.11 [ 3] 22 ALLOW IN 192.168.0.12
Even if the ufw is disabled, you can see the rules by input the show ufw added.
LYSH@MyHostName# show ufw added ufw allow from 192.168.0.10 to any port 22 ufw allow from 192.168.0.11 to any port 22 ufw allow from 192.168.0.12 to any port 22
Enable / Disable
You can enable or disable ufw in the configuration mode.
Remember that you must change the default incoming rule to "allow" before enabling ufw and change the default incoming rule as "deny" after adding all rules. If not, Current or existing ssh connections are disrupted and some imRAD services can be blocked.
LYSH@MyHostName# configure
configure# ufw default allow
configure# ufw enable
configure# exit
LYSH@MyHostName# show ufw
Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To disable, just enter ufw disable.
LYSH@MyHostName# configure configure# ufw disable configure# exit
Note that you'd better add "allow" rules and set the default incoming rule to "deny". If you set the default incoming rule to "allow", there are too many rules to deny. Therefore, you have to change the incoming rule to "deny" after all rules
Enable Summary
| mode | command | Description |
|---|---|---|
| configuration | ufw default allow |
change the default incoming rule to "allow" |
| configuration | ufw enable |
enable ufw |
| user | show ufw |
verify the status of ufw |
| configuration | ufw allow {syntax} |
Add a "allow" rule. Remember that you should add all rules including the Required rules. |
| user | show ufw added |
verify the status of ufw and rules, |
| configuration | ufw default deny |
change the default incoming rule to "deny" |
| user | show ufw added |
verify the status of ufw and rules, |
rules
You can configure rules in the configuration mode.
Basic syntax
If you add a rule, the new rule will be added at the end of the existing rule(s). If you insert a rule, the new rule will be inserted corresponding RULE as rule number NUM.
Rule ordering is important and the first match wins. Therefore when adding rules, add the more specific rules first with more general rules later[3].
To delete a rule, use the ufw delete command.
A rule can be either "allow", "deny", or "reject". The "deny" rule means that it discards incoming packets. The "reject" rule means that it sends back an error packet to the sender.[4]
LYSH@MyHostName# configure configure# ufw allow 22 // To allow incoming tcp and udp packet on port 22. configure# ufw allow 23/tcp // To allow incoming tcp packet on port 23. configure# ufw deny 24/udp // To deny incoming udp packet on port 24. configure# ufw allow ssh // To allow ssh by name. configure# ufw allow from 192.168.0.1 // To allow packets from 192.168.0.1. configure# ufw deny from 192.168.0.1/24 // To deny packets from 192.168.0.1/24.
To allow access to port 22 from 192.168.0.4.
configure# ufw allow from 192.168.0.4 to any port 22
To allow access to port 22 from 192.168.0.4 using TCP.
configure# ufw allow from 192.168.0.4 to any port 22 proto tcp
To allow access to port 22 from 192.168.0.x IPs using TCP.
configure# ufw allow from 192.168.0.4/24 to any port 22 proto tcp
Add or Insert rules
You can add a "allow" rule at the end by type the command ufw allow {syntax}.
If you want to insert a rule before existing rule. enter the ufw insert {number} allow {syntax}.
LYSH@MyHostName# configure configure# ufw allow from 192.168.0.10 to any port 22 configure# ufw allow from 192.168.0.20 to any port 22 configure# exit
You can see the "ALLOW" rules that entered later has a higher number. In other words, If you add a rule, the rule is located at the end.
LYSH@MyHostName# show ufw Status: active Logging: on (low) Default: allow (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10 [ 2] 22 ALLOW IN 192.168.0.20
If you want to add a rule at the specific number, enter the ufw insert {number} allow {syntax}. This will shift down the rules whose number is equal to or greater than the {number}.
LYSH@MyHostName# configure
configure# ufw insert 2 allow from 192.168.0.15 to any port 22
configure# exit
LYSH@MyHostName# show ufw Status: active Logging: on (low) Default: allow (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10 [ 2] 22 ALLOW IN 192.168.0.15 [ 3] 22 ALLOW IN 192.168.0.20 // shift down
By default, no logging is performed when a packet matches a rule. Specifying log will log all new connections matching the rule, and log-all will log all packets matching the rule. For example, to deny and log the specific rules
LYSH@MyHostName# configure configure# ufw deny log from 192.168.0.100 to any port 22 proto tcp configure# exit
Now if the host(i.e. 192.168.0.100) connects to the device via ssh, you can see the "BLOCK" log.
LYSH@MyHostName# show log ufw 2021-04-26 14:55:27 4 0 MyHostName kernel: [7282110.099052] [UFW BLOCK] IN=eth0 OUT=MAC=00:15:5d:03:1e:57:00:04:96:34:b5:e9:08:00 SRC=192.168.0.100 DST=192.168.0.200...
Required rules
You must specify these rules to have all imRAD services work properly. You'd better copy all the following rules and then paste them.
Note that if your system does not need to serve some services, you can ignore their rules. Please refer to the ImRAD port to verify what the port number means.
LYSH@MyHostName# show ufw added ufw allow 80/tcp ufw allow 443/tcp ufw allow 6710/tcp ufw allow 1812/udp ufw allow 1813/udp ufw allow 1813/tcp ufw allow 1812/tcp ufw allow 18123/udp ufw allow 67/udp ufw allow 68/udp ufw allow 547/udp ufw allow 546/udp ufw allow 6010/udp
Specify your IP address to access via SSH.
configure# ufw allow from {your ip address} to any port 22 proto tcp
Deleting rules
To delete a rule, simply prefix the original rule with delete or specify the rule number.
LYSH@MyHostName# show ufw
Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
[ 1] 22 ALLOW IN 192.168.0.10
[ 2] 22 ALLOW IN 192.168.0.15
[ 3] 22 ALLOW IN 192.168.0.20 // shift down
LYSH@MyHostName# configure
configure# ufw delete 2
configure# exit
LYSH@MyHostName# show ufw
Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
[ 1] 22 ALLOW IN 192.168.0.10
[ 2] 22 ALLOW IN 192.168.0.20
You can also delete a rule using the original rule.
LYSH@MyHostName# show ufw added ufw allow from 192.168.0.10 to any port 22 ufw allow from 192.168.0.20 to any port 22 LYSH@MyHostName# configure configure# ufw delete allow from 192.168.0.20 to any port 22 configure# exit LYSH@MyHostName# show ufw Status: active Logging: on (low) Default: allow (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10
default rule TO "deny"
If you definitely added all "allow" rules including the Required rules, change the default incoming rule to "deny". Be sure that there is a rule to access the SSH from your IP address before changing the default rule to "deny".
LYSH@MyHostName# configure configure# ufw default deny configure# exit
LYSH@MyHostName# show ufw
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
[ 1] 22 ALLOW IN 192.168.0.10
[ 2] 22 ALLOW IN 192.168.0.20
If your SSH connection was disrupted because you missed a "allow" rule from your device after changing the default rule to "deny", you should connect the device using the "console" and add an "allow" rule.
reset
If you reset the ufw, all rules are deleting. Also, the default incoming rule is changed to "allow", and the ufw status is changed to "disable".
LYSH@MyHostName# configure configure# ufw reset configure# exit LYSH@MyHostName# show ufw Status: inactive LYSH@MyHostName# show ufw added (None)
log
The ufw logs blocked packets not matching the defined policy and you can see them by the show log ufw in the user mode.