= Firewall exercises using ufw = In this exercise, we will see examples of how to set up a simple host protection using the Uncomplicated Firewall (ufw) to configure the iptables firewall. All the commands in this exercise need to be done as '''root'''. If you are not already root, start a root shell like this: {{{ $ sudo -s # }}} === Installation === note: In this lab session you don't have to install ufw as it comes default with ubuntu {{{ # apt-get install ufw }}} This will install iptables as a dependency if it is not already installed. === Check initial state === Use the ufw status commands {{{ # ufw status Status: inactive }}} And iptables command {{{ # iptables -L -n -v Chain INPUT (policy ACCEPT 44579 packets, 8596K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 52080 packets, 4315K bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 25720 packets, 2713K bytes) pkts bytes target prot opt in out source destination }}} The iptables output shows that the firewall is "permit everything" - there are no rules in any of the chains, and the "policy" of ACCEPT is the default if no rule matches. === Prepare to enable === When we enable the firewall, it's important we '''don't block ssh''' or we could lock ourselves out! ufw may already know about some applications, including OpenSSH, so we can just apply the rule it knows about. {{{ # ufw app list Available applications: Apache Apache Full Apache Secure OpenSSH }}} Alow OpenSSH {{{ # ufw allow OpenSSH Rules updated Rules updated (v6) }}} This policy allows SSH from any IP address. If that's not what you want, you could have added a more specific rule by hand. === Enable firewall === Now let's go ahead and enable the firewall: {{{ # ufw enable }}} Command may disrupt existing ssh connections. Proceed with the operation (y|n)? y The firewall is active and enabled on system startup {{{ # ufw status Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6) }}} If you like, you can check the iptables ruleset again: {{{ # iptables -L -n -v }}} ... but this shows a long configuration over multiple screens. Buried in this you may be able to locate the rule which actually permits ssh: {{{ Chain ufw-user-input (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 /* 'dapp_OpenSSH' */ }}} "ufw status" is much easier! === Firewall rules === Let's try a simple firewall rule. Let's block everyone from ssh into your Ubuntu VM except for your host machine. Before adding the rule ask your neighbor to try ssh into your Ubuntu VM. He should be able to log in. Now add the following rules. Note that you have to give them in the given sequence. {{{ #ufw allow proto tcp from < IPv4 of Your host machine >/32 to any port 22 Rule added #ufw allow proto tcp from < IPv6 of Your host machine >/128 to any port 22 Rule added (v6) }}} This rule is explained as you are allowing all TCP packets coming from your host machine to port 22(SSH port) Now add the following rule to deny packets from any other IP addresses to port 22 {{{ #ufw deny OpenSSH Rules updated Rules updated (v6) }}} Check the status {{{ # ufw status Status: active To Action From -- ------ ---- OpenSSH DENY Anywhere 22/tcp ALLOW OpenSSH (v6) DENY Anywhere (v6) 22/tcp ALLOW }}} Now ask your neighbor to ssh into your VM === Disable ufw === Finally, turn off ufw completely. This is useful for debugging problems, and for our labs we want to make sure that ufw is not going to get in the way of any other exercises. {{{ # ufw disable Firewall stopped and disabled on system startup # ufw status Status: inactive }}} If you are in a root shell, type "exit" to return to your normal user shell.