Is the implicit deny of UFW only for when people are connecting to its IP address or for the whole network? I have tried telnet to the IP address and yes it gets denied but when I tried to telnet to another IP in the network it was able to connect shouldn't it be denied as well?
1 Answer
Based on your comments, I think you've failed to understand what ufw
is, and what the scope of coverage is for software firewalls on individual systems.
This is a breakdown of the situation, and provides insight into the specifics of ufw
and the rules on a network:
ufw
will only affect one system - the system it's enabled on. That is to say, Ubuntu System #1 (for sake of keeping track) hasufw
enabled with an implicit deny rule. That only affects Ubuntu System #1, and replaces the default "ACCEPT" rule that exists on the underlyingiptables
/netfilter
system (of whichufw
is just a 'easy to manage' front end for).- Since Ubuntu System #2 does not have
ufw
enabled on it, there is no "deny" rule on it. Sinceufw
isn't there, the underlyingiptables
/netfilter
system gets the default "ACCEPT" rule that is put in place on install (ufw
changes those rules, and is just an 'easy to manage' front end for those). - Windows Firewall on Windows XP (if enabled) will be able to deny connections to the Windows machine. It cannot affect other systems on the network
If you want Ubuntu System #2 to have the deny rule, install ufw
on that system, enable it, and then the implicit deny rule will exist.
What you want, though, is a network-wide access control rule, controlling what traffic is permitted between systems. The only way to achieve this is to move the firewall and network controls to its own device, a separate Ubuntu box handling routing of traffic between all systems on your network, or a hardware Firewall to achieve this (such as a Cisco ASA, or a pfSense appliance).
Consider the following network:
I have a LAN network, and there's a router handling connections out from LAN to Internet (or other networks). Every computer has 192.168.252.XXX, with static addressing. Five computers are on that segment of the network. I want to restrict communication between the machines to be ICMP PING
packets only, and apply that restriction to all machines.
My options for implementation are as follows:
Install software firewalls on each machine, and configure the software firewalls to accept only certain types of traffic from the other machines on the network to each computer. However, allow all traffic between each system and the gateway/router.
Install a hardware firewall that suits your network setups to replace the router, and provide explicit rule definition for permitted intra-network traffic (internal to the specific LAN) and inter-network traffic (communication between networks, so outside your LAN). Configure as follows
- Configure the hardware firewall to allow outbound to the Internet (a rule basically saying Anything Internal -> Anything Not Internal (NOT 192.168.252.0/24) is ALLOWED).
- Configure the hardware firewall for the LAN itself for ALLOWED inter-system traffic, in this case ICMP only (a rule basically saying anything from 192.168.252.0/24 to 192.168.252.0/24 where the protocol is ICMP).
- Any traffic patterns that do not match aforementioned rules is automatically denied.
Replace the router with an Ubuntu box with enough ethernet ports to provide enough connections for your network and Wireless if you need it, configure it to do DHCP, NAT, etc., and configure the firewall rules on the Ubuntu box to handle traffic both inside and outside the network (similar to previous).
To provide you with another point of view, though, which drives this answer, my network at home has a lot of LAN segments (as VLANs, or Virtual LANs). I use a hardware firewall (a pfSense appliance, $500ish) to handle the VLANs on my network (DHCP, NAT out to the Internet, etc.), as well as inter-communication rules between the segments, which restrict access. Machines I actively use exist on one VLAN, whereas restricted-access machines exist on a separate VLAN and network range. Communication to those is restricted by a rule on both sides which dictates what traffic is permitted to pass between the segments. Essentially, this is the second option from above, implemented in a much more advanced way.
-
Oh ok I understand but for example if I deny port 80 (http) on a certain IP that computer with that IP won't be able to access certain websites right? Jun 17, 2015 at 15:07
-
@user3435500 No, you have two directions for traffic: INBOUND and OUTBOUND. The rule you have to deny Telnet is for "INBOUND" traffic to "Ubuntu System #1". All other systems will still be able to communicate otherwise. If the rule were put into the "OUTBOUND" rules for any one system to deny Port 80, then that system would not be able to reach http sites. If your rule is on US#1 to "ALLOW 80 INBOUND" then that accepts any traffic heading TO that box on port 80, and then responds accordingly where the OUTBOUND rules permit.– Thomas Ward ♦Jun 17, 2015 at 15:13
-
So for example if I want my windows XP to not be able to access any http sites what command must i perform on UFW? Jun 17, 2015 at 15:15
-
@user3435500 You still fail to understand the scope of
ufw
.ufw
only applies to the machine it is installed on. It has zero effect on the traffic patterns of other computers, it merely controls the rules for the system it is installed on, and that's all. To control the traffic on your Windows XP box, you have to configure the Windows firewall, or put a firewall appliance on your network that can make rulesets that affect multiple networked systems at once (which would include your WinXP and Ubuntu boxes)– Thomas Ward ♦Jun 17, 2015 at 15:17 -
Oh ok I see would you happen to know if FirewallD can support the whole network? Jun 17, 2015 at 15:35
ufw
(i.e. "is it one computer or the entire network the rule affects" being the effective question)