13

should I install something like gufw?

6
  • 5
    I think this questions is much too broad to get an objective, correct answer. Feb 17, 2011 at 16:17
  • I am assuming you mean a host-based firewall, not a standalone one. But I agree with Stefano that this this is too broad a topic for a clear answer. A lot depends on context -- where your system is, what services you are running, what other security controls are in place, what the value of your uptime (for denial of service) and data is (financial, proprietary, irreplaceable), etc. The general principle for cautious security is to use multiple protections. If it doesn't get in the way of your day-to-day activity, adding an extra layer of security has few drawbacks, and probable benefits.
    – belacqua
    Feb 17, 2011 at 18:25
  • Also, sudo nmap localhost . Do you have open ports now? (A rough estimation.)
    – belacqua
    Feb 17, 2011 at 18:37
  • sudo nmap localhost this command does not work
    – TheXed
    Feb 18, 2011 at 4:23
  • 1
    @TheX thats because namp isnt installed? Feb 18, 2011 at 6:07

8 Answers 8

7

Yes, more than ever. The internet hasn't changed a lot, since the old days. So a firewall is still a necessity these days. A firewall like gufw, with basic rules works. Use iptables, if you are a CLI geek ;)

9
  • dangit, please comment why you downvoted. Feb 17, 2011 at 10:33
  • 1
    vote++; echo "Use iptables" - I assume I\'m a real CLI geek then :p;
    – Lekensteyn
    Feb 17, 2011 at 14:08
  • 1
    Incorrect answer.
    – psusi
    Feb 17, 2011 at 15:18
  • 1
    @psusi Are you saying that this is incorrect because you disagree with the premise that using a host-based firewall is a good idea, or because you disagree with the ufw/iptables assessments?
    – belacqua
    Feb 17, 2011 at 18:17
  • 1
    @jgbelacqua it is incorrect because a host based firewall for an Ubuntu desktop system is pointless, not needed more now than ever. The question Manish linked to has very good explanations as to why.
    – psusi
    Feb 17, 2011 at 20:40
5

Please check this reply for furthur discussion on Firewalls on Ubuntu.

Why is the firewall disabled by default?

3

Undoubtedly, it only takes a single opportunistic snooper to cause no end of trouble. The confusion lies in how you go about ensuring you're behind a firewall.

This is discussed in more detail here: Is there a preinstalled or automatic firewall? but in short if you are on a home network, behind a wireless router, then your router will normally be performing firewall duties. Obviously its a good idea to check with the manufacturer before you rely on anything (its also dependent on the router configuration).

GUFW is not, in itself, a firewall, just a GUI for ubuntu's default firewall (UFW). UFW is switched off by default. Generally speaking, its advisable to only run one firewall, to avoid potential conflicts, so provided you are on a trusted home network (and you're positive your router provides adequate protection), id advise switching off your software firewall (UFW).

Obviously, switch it back on again when you're on a public / non trusted network.

3
  • There's no harm running a personal software firewall ... it's generally a good idea and offer 'defense in depth' against any poorly behaved machines on your local network.
    – Nerdfest
    Feb 17, 2011 at 12:30
  • Im in agreement, so long as the firewalls are configured the same way. The number of hours ive spent diagnosing network problems, only to discover two firewalls are not in agreement over what they're allowing through...
    – richzilla
    Feb 17, 2011 at 12:48
  • 1
    Inside my LAN: no firewall. Facing the internet: of course firewall. I firewall based on how I trust the computers I connect to.
    – djeikyb
    Feb 18, 2011 at 1:16
2

I would recommend to install a firewall. Something is always better than nothing. isn't it?. Ubuntu , By default comes with a firewall 'ufw'. gufw(Mentioned in the question) is nothing but the GUI of 'ufw'.

Hope this helps.

5
  • 1
    Just a note: iptables is not a firewall. Netfilter is, which is part of the linux kernel. iptables is a command line utility only which is used to modify/query netfilter ruleset.
    – LGB
    Feb 17, 2011 at 8:39
  • Another incorrect answer.
    – psusi
    Feb 17, 2011 at 15:18
  • @LGB from wikipedia: iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Now I am confused. Feb 17, 2011 at 15:47
  • @aneesheep I would say this is misleading, because uwf is a front-end for iptables (which is an interface to netfilter). You can't have ufw installed without iptables in place.
    – belacqua
    Feb 17, 2011 at 18:33
  • Thank you friends for leading me to the right direction. I have removed the iptables section from my answer.
    – aneeshep
    Feb 18, 2011 at 6:24
1

Ubuntu should come with a default firewall activated with a GUI tool too. I'm surprised it doesn't come with it. I know iptables is already there but there are no rules loaded. You have to do that manually or install something like Firestarter to get the basics running for you.

I was so surprised one day when I found out that my ISP gives me my own public IP every time I enable my DSL. Imagine how many hits, ssh login attempts, other scans and MS exploits (yeah someone was running that on my ISP's IPs) my machine was getting the entire time. LOL! :)

3
  • 2
    And your machine quite happily ignores all of them without the need for a firewall.
    – psusi
    Feb 17, 2011 at 15:26
  • The machine doesnt ignore, if there is a service listening on a particular port. In fact, I daresay the machine is eager to accept connections. Feb 17, 2011 at 16:03
  • 1
    @Kaustubh P if there is a service listening on the port, then you WANT it to accept connections, and will have opened that port in the firewall. If there is not, then it rejects connections to that port.
    – psusi
    Feb 18, 2011 at 5:01
1

By definition a firewall blocks communication that otherwise would be allowed. A desktop Ubuntu machine has no services installed by default that will accept connections, so there is nothing for a firewall to block access to. Therefore, it is completely useless.

The reason a firewall is considered necessary on Windows is because it comes with several brain dead services installed by default that accept connections and allow the other party to do things with your computer that you don't want.

7
  • "completely useless" - wrong. A firewall adds an extra layer of defence. You're providing incorrect information too, a default Ubuntu installation has services exposed to the public. For example, it provides CUPS (Common Unix Printing System) listening on UDP port 631.
    – Lekensteyn
    Feb 17, 2011 at 15:32
  • 1
    If you install a new service, that uses other ports, they will be left open, unless you close them, or regulate them with a firewall. Feb 17, 2011 at 15:54
  • The OP doesn't mention desktop or server. Even on a desktop system, as @Kaustubh says, there is no guarantee that, once you depart from the original set-up, ports won't be open. And sometimes, ports are inadvertently left open in updates.
    – belacqua
    Feb 17, 2011 at 18:39
  • @Lekensteyn: It is not wrong. I suggest that you read the other question that Manish linked to where it was also clearly explained. When the port is already closed, a program that closes ports is useless. CUPS also only accepts connections from localhost by default.
    – psusi
    Feb 17, 2011 at 20:32
  • 2
    Please see wiki.ubuntu.com/SecurityTeam/FAQ#UFW If you want to enable ufw, it is trivial to do so. "sudo ufw enable"
    – Kees Cook
    Feb 18, 2011 at 5:49
1

With the introduction of IPv6 having a firewall will become even more critical. Unlike IPv4 where most systems are relatively secured on private IP ranges, IPv6 devices are likely to be fully accessible.

Having a firewall with a default deny policy will be even more critical. Finding devices to scan will be more difficult due to the sparse use of addresses. Keeping some protocols like SMB on link local addresses will help, but won't be a magic bullet.

That said in a default install an active firewall is just an extra layer of security. Many of the applications which do open ports will require their ports to be opened to allow them to work. Pretty well all have additional methods to secure them. Enable all the appropriate layers as required.

EDIT: There have been a lot of comments about letting the application control access and other reasons not to have a firewall. Unfortunately, many applications don't have access controls. Others listen on all addresses, so a firewall becomes the sole way of restricting access from certain interfaces.

As I noted above, a firewall is only one layer of security. Secure applications are another, but you can't easily ensure that your users only run secure applications. A firewall is one way of protecting your users.

No reasonable security measures are totally secure. While many users may not be interested or educated enough to fully understand a firewall, that is not a reason not to use a firewall, or for them no to have a firewall.

6
  • 3
    The default policy WITHOUT a firewall is to reject connections. You don't need a firewall to do that; you use a firewall to change the policy BACK to reject when you have already installed a service that is trying to accept. Of course, if you want to do that, then just don't install the service to accept the connection in the first place.
    – psusi
    Feb 17, 2011 at 15:25
  • 1
    @psusi. Uninstalling the service is a yes/no solution. Using a firewall allows fine grained control.
    – BillThor
    Feb 17, 2011 at 15:35
  • it does allow fine grained control, but the service itself usually allows even more fine grained control. When you install a service, you configure it to accept the kind of connections you want rather than using a separate tool to restrict it. Services also have sane defaults so that when you install them, they either only accept connections from the local host, or local network, so again, there is no need for a firewall.
    – psusi
    Feb 17, 2011 at 20:37
  • @psusi Granted services often have fine grained control. But they don't always log when they drop the connection in a consistent manner. A firewall can provide consistent logging, although scanning the other logs is useful. A firewall can also log probes of missing services. This can allow blocking the originating host in a proactive manner.
    – BillThor
    Feb 18, 2011 at 4:44
  • your average desktop user does not know or care about that kind of thing. Of course there are some things you can do with ipchains that you can't do with a given daemon, but nothing that the average desktop user would consider "necessary".
    – psusi
    Feb 18, 2011 at 4:58
0

Everyone is correct, be careful and probably use some kind of protection, it can create some hassle depending on what you do but sometimes you don't notice how much that extra hassle is really protecting you.

One way you could add some extra protection that isn't really intrusive at all would be to look into OpenDNS, basically just adds some nice control and extra security features for basic internet use.

Not the answer you're looking for? Browse other questions tagged .