0

I've read the ubuntu developer docs regarding the ufw here, but couldn't find what I was looking for. It allows me to set rules for controlling in/out traffic based on source IP or port numbers, but what I want is to restrict based on applications. For example:

(1) only firefox executable allowed to communicate on port 80 - outgoing

(2) only apache/httpd executable allowed to communicate on port 80 - incoming, etc.

(Hope you get what I'm trying to imply - this is possible in windows firewall).

I'm not able to see how I can achieve this with ufw firewall? Or is there a better alternative to ufw which is able to do this on linux?

Improve this question
3
  • There is no program based firewall in Linux. The logic is - if you do not trust an application, do not use it. As you can imaging, the topic has been discussed to death.
    – mikewhatever
    Mar 11, 2013 at 3:22
  • @mikewhatever - Are you sure it is not available in entire linux, cause this feature is available in windows since xp. My logic, like many others is: I definitely trust all my applications, but don't want to expose them to internet, lest any security-vulnerability be exploited in them.
    – Prahlad Yeri
    Mar 11, 2013 at 3:25
  • You are asking the wrong question, it's not anything you do with ordinary firewalls. I think you can do this with an extention to iptables, but not in ufw. And you can do this with SE Linux.
    – Anders
    Mar 12, 2013 at 1:37

1 Answer 1

Reset to default
1

I believe @mikewhatever is correct, that you can't restrict certain applications ... at least not using ufw / iptables

But it sounds like you're on a desktop version of ubuntu (not server). If so, you might consider installing gufw -- which is the GUI frontend for ufw. Once installed, you can add rules in many ways, one of which is based on preconfigured "applications".

selecting a rule for application

To install gufw, open a terminal and type:

sudo apt-get install gufw
Improve this answer
4
  • Thanks for the info mike. With gufw, is it possible to set a rule like this: rule-1:Ignore all outgoing requests, rule2:allow a preconfigured app firefox ? (so that except firefox, no other app should communicate with the outside world, not even ssh, etc.) ?
    – Prahlad Yeri
    Mar 11, 2013 at 15:21
  • No, you can't. You can only say that a port can't be used in I certain direction. The "application" is a macro that tells which ports are used by a server. MS can't do this in their firewall either. But you can tell what applications can do, like which files to open, which executables tugger are allowed to execute and so on. In Linux you can do that with SE Linux. So you should have a look at that for the functionality you ask for.
    – Anders
    Mar 12, 2013 at 1:32
  • @Anders - MS firewall "can" control in/out access based on firewall. For eg. in my Win7 partition, I've allowed only "firefox.exe" program to communicate on port 80-out - This is done in the advanced settings section of the firewall in the control panel. I was basically looking for a simpler solution, SELinux sounds a bit complicated as it involves patching/playing with the kernel, and I'm no expert with that. Aren't there any other advanced firewalls other than gufw for linux that may allow this ?
    – Prahlad Yeri
    Mar 12, 2013 at 3:41
  • Just because you set it in the firewall tab doesn't mean that you set the firewall. What you want is what selinux does to get what you do in MS Windows. You set privileges to users and/or programs. Which isn't the firewalls job, it's the OS. In the same way it's not the firewalls job to controlling access to files. There are three(?) frameworks for using selinux, which you can use. One is the primary one used in Ubuntu. It uses selinux like ufw uses iptable for the firewall. And I do think you just need to activate it when you boot, but have not tried it myself.
    – Anders
    May 28, 2013 at 21:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .