IRC service and UFW firewall rules

Question

I am securing my computer and have created same rules by utilizing UFW at CLI.

My question is this, in order to allow IRC services with XChat 2.8.8, and because IRC service uses ports 6667 through 7000, do I have to write a rule for each port, like:

sudo ufw allow out 6667/tcp
sudo ufw allow out 6668/tcp
sudo ufw allow out 6669/tcp
....
sudo ufw allow out 7000/tcp

Or can I do something this way:

sudo ufw allow out 6667:7000/tcp

On the same subject let me ask you another question, does IRC just uses TCP protocol or do I also have to write equal rules for the UDP protocol?

Answer 1

The manpage of ufw in the RULE SYNTAX section explains the port range part of your question quite well I guess. Hard to get an excerpt with only relevant information from it, so to summarize by example:

• /tcp just makes the rule only match TCP. Removing that will match all traffic, including UDP and possibly other future protocols with port numbers.
• Ranges are indeed specified as you described. 6667:7000 matches all ports from 6667 up to and including 7000.
• Multiple ranges or individual ones can be separated by commas, e.g. 6667,6669:7000 will be the same as above, but excluding 6668.

Wikipedia on IRC mentions this as the protocol/ports required to use it:

IRC was originally a plain text protocol (although later extended), which on request was assigned port 194/TCP by IANA. However, the de facto standard has always been to run IRC on 6667/TCP and nearby port numbers (for example TCP ports 6660–6669, 7000) to avoid having to run the IRCd software with root privileges.

So, this should do the trick for most common outgoing IRC connections:

sudo ufw allow out 6660:7000/tcp

And look for documentation on the IRC server you're connecting to if available. For example FreeNode:

All freenode servers listen on ports 6665, 6666, 6667, 6697 (SSL only), 7000 (SSL only), 7070 (SSL only), 8000, 8001 and 8002.

Answer 2

I'm not proficient with Xchat, but I found that the following was sufficient-

sudo ufw allow out ircd

I think it does same effect as sudo ufw allow out 6667.