ufw
The imRAD system uses "ufw" as a default firewall configuration.[1] UFW is a front-end for iptables and is particularly well-suited for host-based firewalls. Users can therefore configure the firewall to allow certain types of network traffic to pass into and out of a system (for instance SSH or web server traffic). This is done by opening and closing TCP and UDP "ports" in the firewall. Additionally, firewalls can be configured to allow or restrict access to specific IP addresses (or IP address ranges).[2]
You can enable or disable using the ufw enable or ufw disable command in the configuration mode.
The status of ufw is initially in disable. Therefore, you may enable it if necessary.
We introduce basic syntax and examples. For more details, Please visit the https://help.ubuntu.com/community/UFW.
Verifying ufw
LYSH@MyHostName# show ufw // ufw is in disable Status: inactive
The following example is a typical configuration when ufw is in enable.
LYSH@MyHostName# show ufw // ufw is in enable Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10 [ 2] 22 ALLOW IN 192.168.0.11 [ 3] 22 ALLOW IN 192.168.0.12
Enable / Disable
You can enable or disable ufw in the configuration mode. Remember that you must change the default incoming rule to "allow" before enabling ufw and change the default incoming rule as "deny" after adding all rules. If not, Current or existing ssh connections are disrupted and some imRAD services can be blocked.
LYSH@MyHostName# configure
configure# ufw default allow
configure# ufw enable
configure# exit
LYSH@MyHostName# show ufw // ufw is in disable
Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To disable, just enter ufw disable.
LYSH@MyHostName# configure configure# ufw disable configure# exit
Note that you'd better add "allow" rules and set the default rule to "deny". If you set the default rule to "allow", there are too many rules to deny. Therefore, you have to change the incoming rule to "deny" after all rules
Enable Summary
| mode | command | Description |
|---|---|---|
| configuration | ufw default allow |
change the default rule to "allow" |
| configuration | ufw enable |
enable ufw |
| user | show ufw |
verify the status of ufw |
| configuration | ufw allow {syntax} |
Add a "allow" rule. Remember that you should add all rules including the Required rules. |
| user | show ufw |
verify the status of ufw |
| configuration | ufw default deny |
change the default rule to "deny" |
| user | show ufw |
verify the status of ufw |
Allowing rules
You can add a rule at the end of existing rule and can insert a rule at the specific position.
Basic syntax
LYSH@MyHostName# configure configure# ufw allow 22 // To allow incoming tcp and udp packet on port 22. configure# ufw allow 23/tcp // To allow incoming tcp packet on port 23. configure# ufw allow 24/udp // To allow incoming udp packet on port 24. configure# ufw allow ssh // To allow ssh by name. configure# ufw allow from 192.168.0.1 // To allow packets from 192.168.0.1. configure# ufw allow from 192.168.0.1/24 // To allow packets from 192.168.0.1/24.
To allow IP address 192.168.0.4 access to port 22 for all protocols.
configure# ufw allow from 192.168.0.4 to any port 22
To allow IP address 192.168.0.4 access to port 22 for all protocols using TCP.
configure# ufw allow from 192.168.0.4 to any port 22 proto tcp
To allow IP address 192.168.0.4/24 access to port 22 for all protocols using TCP.
configure# ufw allow from 192.168.0.4/24 to any port 22 proto tcp
Adding rules
You can add a "allow" rule at the end by type the command ufw allow {syntax}.
If you want to insert a rule before existing rule. enter the ufw insert {number} allow {syntax}.
LYSH@MyHostName# configure configure# ufw allow from 192.168.0.10 to any port 22 configure# ufw allow from 192.168.0.20 to any port 22 configure# exit
You can see the "allow" rules that entered later has a higher number. In other words, If you add a rule, the rule is located at the end.
LYSH@MyHostName# show ufw Status: active Logging: on (low) Default: allow (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10 [ 2] 22 ALLOW IN 192.168.0.20
If you want to add a rule at the specific number, enter the ufw insert {number} allow {syntax}. This will shift down the rules whose number is equal to or greater than the {number}.
LYSH@MyHostName# configure
configure# ufw insert 2 allow from 192.168.0.15 to any port 22
configure# exit
LYSH@MyHostName# show ufw Status: active Logging: on (low) Default: allow (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW IN 192.168.0.10 [ 2] 22 ALLOW IN 192.168.0.15 [ 3] 22 ALLOW IN 192.168.0.20 // shift down
Required rules
You must specify these rules to have all imRAD services work properly. You'd better copy all the following rules and then paste them. Note that if your system does not need to serve some services, you can ignore their rules.
LYSH@MyHostName# configure configure# ufw allow radiusd configure# ufw allow dhcpv4 configure# ufw allow dhcpv6 configure# ufw allow failover configure# ufw allow smgr configure# ufw allow logexp configure# ufw allow startup
Specify your IP address to access via SSH.
configure# ufw allow from {your ip address} to any port 22
Deleting rules
To delete a rule, simply prefix the original rule with delete or specify the rule number.
LYSH@MyHostName# configure configure# ufw delete allow from 192.168.0.15 to any port 22 or configure# ufw delete 2 configure# exit
LYSH@MyHostName# show ufw
Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
[ 1] 22 ALLOW IN 192.168.0.10
[ 2] 22 ALLOW IN 192.168.0.20
default rule TO "deny"
If you definitely added all rules including the Required rules, change the default rule to "deny". Be sure that there is a rule to access the SSH from your IP address before changing the default rule to "deny".
LYSH@MyHostName# configure configure# ufw default deny configure# exit
LYSH@MyHostName# show ufw
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
[ 1] 22 ALLOW IN 192.168.0.10
[ 2] 22 ALLOW IN 192.168.0.20