2

Since I've installed Firestarter I have encountered connectivity issues that are all resolved by disabling the firewall. I'd prefer to have the firewall running and allow all the traffic I normally use:

  1. Wired network + wireless network, whichever I'm connected to, or both (1)
  2. OpenVPN
  3. VirtualBox internal network
  4. Samba (for accessing shared Windows folders and sharing folders to Windows) (2)
  5. BitTorrent
  6. And everything else I use that I can't think of :)

All the above works without a firewall.

(1) I used the Firestarter wizard and selected wlan0 as my primary connection, now whenever I plug in a network cable, I lose all connectivity. Should I just redo the wizard for eth0, or will I then lose wlan0?

(2) If it makes a difference I'm sharing a directory that I share between local users using bindfs. See my answer to Good and easy way to share files on local machine

2
  • This is really two questions, one of which would exclude the other. I.e., "Do I really need a firewall?" This has been tackled by various other questions, but is subjective at best. I would eliminate that from your question if you want a good answer for the "how to configure" part.
    – belacqua
    Mar 3, 2011 at 18:53
  • @jgbelacqua: Good points. I've removed the "Do I really need it?" bit.
    – lofidevops
    Mar 4, 2011 at 5:41

7 Answers 7

3

Here is one easy way to do it. My answer is going to assume that you have disabled all other firewall rules / packages you have tried.

Ubuntu has a nice very simple command line interface to "iptables" (Linux firewall) which is call UFW for Uncomplicated FireWall.

simply do this:

sudo ufw status

you'll see that your firewall is currently inactive:

"Status: inactive"

if you then issue the following command:

sudo ufw enable

you'll then get this message if it worked:

"Firewall is active and enabled on system startup"

Final Thoughts / Wrap Up:

Honestly this is all you'll probably need as the default ufw policy allows all outbound traffic (i.e. you surfing, downloading, etc) and blocks all inbound traffic to your box.

If you wanted to allow say... ssh/scp connections to your box/laptop for some reason you could simple add a rule such as this:

sudo ufw allow proto tcp from 192.168.1.0/24 to any port 22

In my opinion the syntax / commands are very simple and a gui app or overlay isn't bad, but not necessarily needed for what you seem to be wanting to achieve.

For more info check out the community docs on UFW here: https://help.ubuntu.com/community/UFW

I hope this has been helpful. =)

##### EDIT ##### (adding this in case people don't see my comment reply below and to add a resource link)

If you are wanting to open up certain ports click this link and look up all the ports you need (tcp and/or udp) for the services you listed: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Then to open that port up from anywhere to your machine do this:

sudo ufw allow proto tcp from any to any port __

or

sudo ufw allow proto udp from any to any port __

If you only want to open it up to ONLY your home 192.168.1.x network you could do this:

sudo ufw allow proto tcp from 192.168.1.0/24 to any port __

or

sudo ufw allow proto udp from 192.168.1.0/24 to any port __
2
  • That will (I think) break BitTorrent, as it will need an open port. Something like sudo ufw allow tcp/25000 will allow inbound TCP connections on port 25000.
    – Scaine
    Mar 3, 2011 at 19:58
  • correct, it would block others connecting to you via bit torrent ports. what you would need to do is what i gave an example for in the "Final Thoughts / Wrap up:" section of my post. (feel free to also look at the community docs I linked.) example: sudo ufw allow proto tcp from any to any port _____ =) Mar 3, 2011 at 21:55
2

First, I'd un-install Firestarter completely. I don't believe that it's still under development any longer (might be wrong), but regardless, it's been superceded by the "official" Uncomplicated Firewall (ufw) which has a nice UI already. So :

sudo apt-get remove firestarter

Then install gufw :

sudo apt-get install gufw

Then reset your IPTables (which is what UFW is based on) :

sudo ufw reset

(you can also do this using gufw, in the Edit menu)

And then finally manage your firewall using that tool. Start GUFW from System/Administration/Firewall Configuration.

GUFW Interface

1
  • thanks, although I picked another answer, your instructions are very clear
    – lofidevops
    Mar 25, 2011 at 9:28
1

the issue you experienced when installed Firestarter means you didn't open the proper ports. After enabling the firewall you need to open all the necessary ports in order services to work.

Samba uses the following:

UDP/137    - used by nmbd
UDP/138    - used by nmbd
TCP/139    - used by smbd
TCP/445    - used by smbd

OpenVPN uses

port 1194
1
  • See my numbers 1 (wired + wireless network simultaneously) and 4 (using Samba to access shared Windows folders and share folders to Windows) for the issues I have experienced so far.
    – lofidevops
    Mar 3, 2011 at 15:13
0

I had a similar problem when using a wired and usb connection.

Turned out some thing was creating iptable rules when I plugged I connected using the USB device as well, which caused me to loose my internet connection.

Not sure if it was firestarter causing it but I did have it installed

0

If you use a gateway (wlan router or something) in this case you don't need a extra firewall on your workstation, because thats not the touchpoint to the internet. Your router manage the filters to the private lan (your workstation).

1
  • 2
    I think it is debatable whether this is true or not. A gateway is not necessarily a firewall device, and even if it is, this doesn't remove all security risks. What's the target system worth? If you are defending a castle with a moat and walls, might you not still have guards posted outside the monarch's chambers?
    – belacqua
    Mar 4, 2011 at 0:28
0

No, you don't need a firewall. Turn it back off and don't worry about it. Just make sure you don't install any server services, and then misconfigure them to be insecure.

1
0

I concur with what schneehase already wrote: considering that Linux is relatively safe as it doesn't leave too many open ports, the best solution in term of easy management is to put all the required shields up on your router/gateway that gives you access to Internet, and to turn off the firewall for a PC that lives inside your LAN. If you want, you can perhaps keep an IDS (intrusion detection system) running on your Ubuntu or other PC.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .