Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

should I install something like gufw?

share|improve this question

closed as not constructive by htorque, Jorge Castro, Kees Cook, Stefano Palazzo Feb 18 '11 at 21:21

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

I think this questions is much too broad to get an objective, correct answer. – Stefano Palazzo Feb 17 '11 at 16:17
I am assuming you mean a host-based firewall, not a standalone one. But I agree with Stefano that this this is too broad a topic for a clear answer. A lot depends on context -- where your system is, what services you are running, what other security controls are in place, what the value of your uptime (for denial of service) and data is (financial, proprietary, irreplaceable), etc. The general principle for cautious security is to use multiple protections. If it doesn't get in the way of your day-to-day activity, adding an extra layer of security has few drawbacks, and probable benefits. – belacqua Feb 17 '11 at 18:25
Also, sudo nmap localhost . Do you have open ports now? (A rough estimation.) – belacqua Feb 17 '11 at 18:37
sudo nmap localhost this command does not work – TheXed Feb 18 '11 at 4:23
@TheX thats because namp isnt installed? – theTuxRacer Feb 18 '11 at 6:07
up vote 7 down vote accepted

Yes, more than ever. The internet hasn't changed a lot, since the old days. So a firewall is still a necessity these days. A firewall like gufw, with basic rules works. Use iptables, if you are a CLI geek ;)

share|improve this answer
dangit, please comment why you downvoted. – theTuxRacer Feb 17 '11 at 10:33
vote++; echo "Use iptables" - I assume I\'m a real CLI geek then :p; – Lekensteyn Feb 17 '11 at 14:08
Incorrect answer. – psusi Feb 17 '11 at 15:18
@psusi Are you saying that this is incorrect because you disagree with the premise that using a host-based firewall is a good idea, or because you disagree with the ufw/iptables assessments? – belacqua Feb 17 '11 at 18:17
@jgbelacqua it is incorrect because a host based firewall for an Ubuntu desktop system is pointless, not needed more now than ever. The question Manish linked to has very good explanations as to why. – psusi Feb 17 '11 at 20:40

Please check this reply for furthur discussion on Firewalls on Ubuntu.

Why is the firewall disabled by default?

share|improve this answer

Undoubtedly, it only takes a single opportunistic snooper to cause no end of trouble. The confusion lies in how you go about ensuring you're behind a firewall.

This is discussed in more detail here: Is there a preinstalled or automatic firewall? but in short if you are on a home network, behind a wireless router, then your router will normally be performing firewall duties. Obviously its a good idea to check with the manufacturer before you rely on anything (its also dependent on the router configuration).

GUFW is not, in itself, a firewall, just a GUI for ubuntu's default firewall (UFW). UFW is switched off by default. Generally speaking, its advisable to only run one firewall, to avoid potential conflicts, so provided you are on a trusted home network (and you're positive your router provides adequate protection), id advise switching off your software firewall (UFW).

Obviously, switch it back on again when you're on a public / non trusted network.

share|improve this answer
There's no harm running a personal software firewall ... it's generally a good idea and offer 'defense in depth' against any poorly behaved machines on your local network. – Nerdfest Feb 17 '11 at 12:30
Im in agreement, so long as the firewalls are configured the same way. The number of hours ive spent diagnosing network problems, only to discover two firewalls are not in agreement over what they're allowing through... – richzilla Feb 17 '11 at 12:48
Inside my LAN: no firewall. Facing the internet: of course firewall. I firewall based on how I trust the computers I connect to. – djeikyb Feb 18 '11 at 1:16

I would recommend to install a firewall. Something is always better than nothing. isn't it?. Ubuntu , By default comes with a firewall 'ufw'. gufw(Mentioned in the question) is nothing but the GUI of 'ufw'.

Hope this helps.

share|improve this answer
Just a note: iptables is not a firewall. Netfilter is, which is part of the linux kernel. iptables is a command line utility only which is used to modify/query netfilter ruleset. – LGB Feb 17 '11 at 8:39
Another incorrect answer. – psusi Feb 17 '11 at 15:18
@LGB from wikipedia: iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Now I am confused. – theTuxRacer Feb 17 '11 at 15:47
@aneesheep I would say this is misleading, because uwf is a front-end for iptables (which is an interface to netfilter). You can't have ufw installed without iptables in place. – belacqua Feb 17 '11 at 18:33
Thank you friends for leading me to the right direction. I have removed the iptables section from my answer. – aneeshep Feb 18 '11 at 6:24

Ubuntu should come with a default firewall activated with a GUI tool too. I'm surprised it doesn't come with it. I know iptables is already there but there are no rules loaded. You have to do that manually or install something like Firestarter to get the basics running for you.

I was so surprised one day when I found out that my ISP gives me my own public IP every time I enable my DSL. Imagine how many hits, ssh login attempts, other scans and MS exploits (yeah someone was running that on my ISP's IPs) my machine was getting the entire time. LOL! :)

share|improve this answer
And your machine quite happily ignores all of them without the need for a firewall. – psusi Feb 17 '11 at 15:26
The machine doesnt ignore, if there is a service listening on a particular port. In fact, I daresay the machine is eager to accept connections. – theTuxRacer Feb 17 '11 at 16:03
@Kaustubh P if there is a service listening on the port, then you WANT it to accept connections, and will have opened that port in the firewall. If there is not, then it rejects connections to that port. – psusi Feb 18 '11 at 5:01

By definition a firewall blocks communication that otherwise would be allowed. A desktop Ubuntu machine has no services installed by default that will accept connections, so there is nothing for a firewall to block access to. Therefore, it is completely useless.

The reason a firewall is considered necessary on Windows is because it comes with several brain dead services installed by default that accept connections and allow the other party to do things with your computer that you don't want.

share|improve this answer
"completely useless" - wrong. A firewall adds an extra layer of defence. You're providing incorrect information too, a default Ubuntu installation has services exposed to the public. For example, it provides CUPS (Common Unix Printing System) listening on UDP port 631. – Lekensteyn Feb 17 '11 at 15:32
If you install a new service, that uses other ports, they will be left open, unless you close them, or regulate them with a firewall. – theTuxRacer Feb 17 '11 at 15:54
The OP doesn't mention desktop or server. Even on a desktop system, as @Kaustubh says, there is no guarantee that, once you depart from the original set-up, ports won't be open. And sometimes, ports are inadvertently left open in updates. – belacqua Feb 17 '11 at 18:39
@Lekensteyn: It is not wrong. I suggest that you read the other question that Manish linked to where it was also clearly explained. When the port is already closed, a program that closes ports is useless. CUPS also only accepts connections from localhost by default. – psusi Feb 17 '11 at 20:32
Please see If you want to enable ufw, it is trivial to do so. "sudo ufw enable" – Kees Cook Feb 18 '11 at 5:49

With the introduction of IPv6 having a firewall will become even more critical. Unlike IPv4 where most systems are relatively secured on private IP ranges, IPv6 devices are likely to be fully accessible.

Having a firewall with a default deny policy will be even more critical. Finding devices to scan will be more difficult due to the sparse use of addresses. Keeping some protocols like SMB on link local addresses will help, but won't be a magic bullet.

That said in a default install an active firewall is just an extra layer of security. Many of the applications which do open ports will require their ports to be opened to allow them to work. Pretty well all have additional methods to secure them. Enable all the appropriate layers as required.

EDIT: There have been a lot of comments about letting the application control access and other reasons not to have a firewall. Unfortunately, many applications don't have access controls. Others listen on all addresses, so a firewall becomes the sole way of restricting access from certain interfaces.

As I noted above, a firewall is only one layer of security. Secure applications are another, but you can't easily ensure that your users only run secure applications. A firewall is one way of protecting your users.

No reasonable security measures are totally secure. While many users may not be interested or educated enough to fully understand a firewall, that is not a reason not to use a firewall, or for them no to have a firewall.

share|improve this answer
The default policy WITHOUT a firewall is to reject connections. You don't need a firewall to do that; you use a firewall to change the policy BACK to reject when you have already installed a service that is trying to accept. Of course, if you want to do that, then just don't install the service to accept the connection in the first place. – psusi Feb 17 '11 at 15:25
@psusi. Uninstalling the service is a yes/no solution. Using a firewall allows fine grained control. – BillThor Feb 17 '11 at 15:35
it does allow fine grained control, but the service itself usually allows even more fine grained control. When you install a service, you configure it to accept the kind of connections you want rather than using a separate tool to restrict it. Services also have sane defaults so that when you install them, they either only accept connections from the local host, or local network, so again, there is no need for a firewall. – psusi Feb 17 '11 at 20:37
@psusi Granted services often have fine grained control. But they don't always log when they drop the connection in a consistent manner. A firewall can provide consistent logging, although scanning the other logs is useful. A firewall can also log probes of missing services. This can allow blocking the originating host in a proactive manner. – BillThor Feb 18 '11 at 4:44
your average desktop user does not know or care about that kind of thing. Of course there are some things you can do with ipchains that you can't do with a given daemon, but nothing that the average desktop user would consider "necessary". – psusi Feb 18 '11 at 4:58

Everyone is correct, be careful and probably use some kind of protection, it can create some hassle depending on what you do but sometimes you don't notice how much that extra hassle is really protecting you.

One way you could add some extra protection that isn't really intrusive at all would be to look into OpenDNS, basically just adds some nice control and extra security features for basic internet use.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.