57

I installed Firestarter, and configured my firewall.

But I'm in doubt : On boot, I sometimes see a [FAIL] marker, and to the left, I guess it was something like "start firewall". I can't be sure because the message is seen for less than a second, so I wanted to know if there is a way, without starting the whole firestarter software, to know if the firewall is on and working, or not.

Either a gadget, or better, some console instruction, the exact name of the firewall process/daemon, or bash script, will do.

Edit: I already tested my computer with the "Shield's Up" http://www.grc.com feature, which marks my computer as "Stealth", but as I am behind a router, I'm not surprised. Still, apparently, my computer answers to pings... Strange...

3
  • 1
    The Ubuntu firewall will let pings through unless you specifically configure it to do otherwise.
    – dieki
    Aug 2, 2010 at 21:37
  • This question appears to be abandoned, if you are experiencing a similar issue please ask a new question with details pertaining to your problem. If you feel this question is not abandoned, please flag the question explaining that. :)
    – Ringtail
    Feb 27, 2012 at 23:08
  • This question has helpful, upvoted answers and consequently is not abandoned. It should be reopened. Apr 13, 2013 at 9:02

5 Answers 5

49

There are basically 2 ways of seeing if the firewall is configured. You should use both of the methods and verify that the firewall is both configured and configured the way you wish it to be.

First, check that the firewall rules have been applied. Pretty much all modern Linux firewall solutions use iptables for firewall. You can see that there are rules in place with iptables command:

iptables -L

This will return the current set of rules. There can be a few rules in the set even if your firewall rules haven't been applied. Just look for lines that match your given rulesets. This will give you an idea of what rules have been entered to the system. this doesn't guarantee the validity of the rules, only that they have been understood.

Next, you will use a second computer to test for connections against the host in question. This can be easily done with the nmap command (found in nmap package). Quick and dirty way of checking is:

nmap -P0 10.0.0.10
nmap -P0 -sU 10.0.0.10

Replace the IP address 10.0.0.10 with your destination hosts IP address.

The first line will scan for TCP ports that are open and available from the second computer. Second line will repeat the scan but this time with UDP ports. -P0 flag will prevent the host from being tested with a ICMP Echo packet, but might be blocked by your firewall rules.

The scan might take a while so be patient. There is also a GUI frontend for nmap called zenmap which makes it a bit easier to interpret the scan results if there is a lot of output.

3
  • 1
    Using another computer was something I would like to avoid (I am behind an external router, which works as a firewall. I already use the firewall testing from grc.com which could be considered as "another computer". Still, thanks for the console instructions.
    – paercebal
    Jul 31, 2010 at 15:37
  • Zenmap seems to give complicated logs, but it is awesome! Thanks for the info. +1, of course.
    – paercebal
    Jul 31, 2010 at 18:47
  • 2
    Worth noting that is should be sudo iptables -L. Otherwise, you will get "command not found", at least on Ubuntu. Apr 18, 2018 at 17:30
38

You can use this command:

ufw status  
6
  • 5
    Note that this only works if you have ufw installed and using it.
    – Braiam
    Dec 14, 2013 at 21:49
  • 5
    ufw is install by default on ubuntu, whether or not you are using it, it tells you the status.
    – windox
    Dec 15, 2013 at 4:30
  • 5
    warning: ufw uses iptables to set firewall rules, but 'ufw status' does not show any additional rules created directly by iptables (not using ufw). For instance, the docker daemon by default happily punches holes in the firewall using iptables, but ufw does not show these!.
    – anneb
    Apr 5, 2016 at 0:35
  • 2
    I would like to say ufw is just a configuration tool, not actually a firewall. and by default it is disabled. Jul 8, 2016 at 13:26
  • 3
    I think this command tells you if ufw itself is enbled or not. The proof is that if you set the firewall with iptables then run ufw status it will still returns Status: inactive Feb 21, 2018 at 11:28
10

To check Firewall status use command:

sudo ufw status

To enable the firewall use command:

sudo ufw enable

To disable the firewall use command:

sudo ufw disable
7

First of all, you can review the syslog for any error messages from services with sudo less /var/log/syslog. That may give you a clue as to why the firestarter service didn't start.

You can manipulate services with the service command. To check whether a service runs, use service [service_name] status. In your case, I guess service_name is just firestarter. You can use tab-completion to get a list of available services (service TAB TAB), or take a look at the contents of directory /etc/init.d (every file is a script to manage a service).

Ubuntu has its own firewall system, called Uncomplicated Firewall (ufw). Maybe it's easier to use that one within Ubuntu. If you install the package gufw, you can access the configuration in System -> Administration -> Firewall configuration.

The iptables command mentioned above works on any Linux system. All Linux firewall configuration tools (like ufw, firestarter, and many others) are basically front-ends to iptables.

0

Question On boot, I sometimes see a [FAIL] marker, and to the left, I guess it was something like "start firewall". I can't be sure because the message is seen for less than a second

All the above answers are complete in themselves and can solve the problem. But here's a little advice from me

Before we start our debugging process, we must analyze the problem description carefully, so you can use slow motion mode of mobile's camera to see what exactly is the error message.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .