mirror of
https://github.com/The-Art-of-Hacking/h4cker.git
synced 2024-08-31 06:22:12 +00:00
227 lines
5.8 KiB
Markdown
227 lines
5.8 KiB
Markdown
![]() |
# UFW: Uncomplicated Firewall — Cheat Sheet
|
|||
|
|
|||
|
## Installation
|
|||
|
If you are using Ubuntu then UFW will be installed by default. If you are using Debian or a derivative, then you can install UFW by entering the following
|
|||
|
```
|
|||
|
root@host:~# apt-get install ufw
|
|||
|
```
|
|||
|
|
|||
|
UFW is not available in CentOS, and although you can install it from source, that is outside the scope of this tutorial.
|
|||
|
|
|||
|
## Checking status
|
|||
|
When you check the status, UFW will either tell you that it is inactive,
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw status
|
|||
|
Status: inactive
|
|||
|
```
|
|||
|
or it will tell you it is active and list the firewall rules.
|
|||
|
```
|
|||
|
root@host:~# ufw status
|
|||
|
Status: active
|
|||
|
To Action From
|
|||
|
-- ------ ----
|
|||
|
22/tcp ALLOW Anywhere
|
|||
|
22/tcp (v6) ALLOW Anywhere (v6)
|
|||
|
```
|
|||
|
|
|||
|
Rules can also be numbered, which is particularly useful when you wish to delete one.
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw status numbered
|
|||
|
Status: active
|
|||
|
To Action From -- ------ ----
|
|||
|
[ 1] WWW Full ALLOW IN Anywhere
|
|||
|
[ 2] WWW Full (v6) ALLOW IN Anywhere (v6)
|
|||
|
|
|||
|
```
|
|||
|
|
|||
|
Not that if you have no rules enables, you will just be told it is active
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw status
|
|||
|
Status: active
|
|||
|
```
|
|||
|
|
|||
|
## Enable and disable
|
|||
|
Enabling and disabling are from the following commands. Warning; if you are working on a remote system, allow the SSH rule before you enable UFW or you risk losing your shell access.
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw enable
|
|||
|
Firewall is active and enabled on system startup
|
|||
|
root@host:~# ufw disable
|
|||
|
Firewall stopped and disabled on system startup
|
|||
|
```
|
|||
|
|
|||
|
## Deleting rules
|
|||
|
The easiest way to delete a rule is to delete it by number, but you can also delete it by definition.
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw status numbered
|
|||
|
Status: active
|
|||
|
To Action From -- ------ ----
|
|||
|
[ 1] 22/tcp ALLOW IN Anywhere
|
|||
|
[ 2] 22/tcp (v6) ALLOW IN Anywhere (v6)
|
|||
|
```
|
|||
|
Note that as there are 2 rules (ipv4 and ipv6) for every pre-defined service, delete will only remove the rule for one protocol.
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw delete 2
|
|||
|
Deleting:
|
|||
|
allow 22/tcp
|
|||
|
Proceed with operation (y|n)? y
|
|||
|
Rule deleted (v6)
|
|||
|
```
|
|||
|
|
|||
|
## Logging
|
|||
|
Logging is on by default, but can rapidly fill your log files with noise. Enable and disable thusly
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw logging on
|
|||
|
Logging enabled
|
|||
|
root@host:~# ufw logging off
|
|||
|
Logging disabled
|
|||
|
|
|||
|
```
|
|||
|
You can also change the logging levels if necessary, but low is the default.
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw logging medium
|
|||
|
Logging enabled
|
|||
|
Pre-defined rules
|
|||
|
```
|
|||
|
|
|||
|
One of the strengths for sysadmins who may only infrequently change firewall rules is the set of pre-defined rules that UFW ships with. These obviously assume that you are running services on default ports and will NOT work if you have tried to obfuscate by assigning non-default ports. They also assume you will be allowing ALL traffic to these port (see later for how to restrict traffic sources and destinations.
|
|||
|
```
|
|||
|
root@host:~# ufw app list
|
|||
|
Available applications:
|
|||
|
AIM
|
|||
|
Bonjour
|
|||
|
CIFS
|
|||
|
CUPS
|
|||
|
DNS
|
|||
|
Deluge
|
|||
|
IMAP
|
|||
|
IMAPS
|
|||
|
IPP
|
|||
|
KTorrent
|
|||
|
Kerberos Admin
|
|||
|
Kerberos Full
|
|||
|
Kerberos KDC
|
|||
|
Kerberos Password
|
|||
|
LDAP
|
|||
|
LDAPS
|
|||
|
LPD
|
|||
|
MSN
|
|||
|
MSN SSL
|
|||
|
Mail submission
|
|||
|
NFS
|
|||
|
POP3
|
|||
|
POP3S
|
|||
|
PeopleNearby
|
|||
|
SMTP
|
|||
|
SSH
|
|||
|
Socks
|
|||
|
Telnet
|
|||
|
Transmission
|
|||
|
Transparent Proxy
|
|||
|
VNC
|
|||
|
WWW
|
|||
|
WWW Cache
|
|||
|
WWW Full
|
|||
|
WWW Secure
|
|||
|
XMPP
|
|||
|
Yahoo
|
|||
|
qBittorrent
|
|||
|
svnserve
|
|||
|
```
|
|||
|
|
|||
|
You can see a full list of these and their definitions in /etc/ufw/applications.d.
|
|||
|
|
|||
|
## SSH
|
|||
|
If you are running a remote server, you almost certainly want this rule enabled.
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw allow ssh
|
|||
|
Rule added
|
|||
|
Rule added (v6)
|
|||
|
root@host:~# ufw status
|
|||
|
Status: active
|
|||
|
To Action From
|
|||
|
-- ------ ----
|
|||
|
22/tcp ALLOW Anywhere
|
|||
|
22/tcp (v6) ALLOW Anywhere (v6)
|
|||
|
http(s)
|
|||
|
|
|||
|
```
|
|||
|
|
|||
|
You can enable both port 80 (http) and 443 (https) in one go with the following command, but there are options to only enable one
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw allow www\ full
|
|||
|
Rules updated
|
|||
|
Rules updated (v6)
|
|||
|
root@host:~# ufw status
|
|||
|
[sudo] password for simon:
|
|||
|
Status: active
|
|||
|
To Action From
|
|||
|
-- ------ ----
|
|||
|
WWW Full ALLOW Anywhere
|
|||
|
WWW Full (v6) ALLOW Anywhere (v6)
|
|||
|
|
|||
|
```
|
|||
|
|
|||
|
## More complex usage
|
|||
|
Port and protocol
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw allow 45/tcp
|
|||
|
Rule added
|
|||
|
Rule added (v6)
|
|||
|
```
|
|||
|
|
|||
|
### Source and Destination
|
|||
|
Allow only from an IP
|
|||
|
|
|||
|
```
|
|||
|
root@host:~# ufw allow from 192.168.1.1 port 62
|
|||
|
Rule added
|
|||
|
root@host:~# ufw status
|
|||
|
Status: active
|
|||
|
To Action From
|
|||
|
-- ------ ----
|
|||
|
Anywhere ALLOW 192.168.1.1 62
|
|||
|
|
|||
|
```
|
|||
|
|
|||
|
Allow only to a certain local interface
|
|||
|
```
|
|||
|
root@host:~# ufw allow to 127.0.0.2 port 62
|
|||
|
Rule added
|
|||
|
root@host:~# ufw status
|
|||
|
Status: active
|
|||
|
To Action From
|
|||
|
-- ------ ----
|
|||
|
127.0.0.2 62 ALLOW Anywhere
|
|||
|
|
|||
|
```
|
|||
|
|
|||
|
### Protocol only
|
|||
|
|
|||
|
If you have followed my ipsec tutorial, you will need the firewall ports open to establish the key exchange – this is one of the few protolcols which do not require a port number.
|
|||
|
```
|
|||
|
root@host:~# ufw allow to 127.0.0.3 proto esp
|
|||
|
Rule added
|
|||
|
|
|||
|
root@host:~# ufw allow to 127.0.0.3 proto ah
|
|||
|
Rule added
|
|||
|
root@host:~# ufw status
|
|||
|
Status: active
|
|||
|
To Action From
|
|||
|
-- ------ ----
|
|||
|
127.0.0.3/esp ALLOW Anywhere
|
|||
|
127.0.0.3/ah ALLOW Anywhere
|
|||
|
```
|
|||
|
|
|||
|
Note that you need a destination in this instance.
|