I've decided to enable the UFW that comes with Ubuntu just to make my system even more secure (especially after watching a video of a person whose computer actually got infected!), and I've enabled UFW and installed GUFW, but I'm not sure what to do next. When I check the status of the firewall, it says that it is active. What are some rules that I should configure to actually make use of the firewall, since right now I'm assuming it's allowing everything, basically acting like it isn't there.
If you've set
If you want more details, run
and you will see something like this
which basically means that all incoming is denied and all outgoing allowed. It's a bit more complicated than that (for example ESTABLISHED - requested - packets are allowed in), and if you're interested in the full set of rules, see the output of
If you have a public IP, you can use an online test to get an idea how good the filtering is, for example www.grc.com (look for ShieldsUP) or nmap-online.
You should also see messages about blocked/allowed packets in logs (/var/log/syslog and /var/log/ufw.log).
A firewall can provide two quite different levels of protection.
You need to start with ONE, and think about TWO later ..
A. Create the script file
B. Set file permission (needed only once)
C. Run the script
ufw has the following features:
Getting started with ufw is easy. For example, to enable firewall, allow ssh access, enable logging, and check the status of the firewall, perform:
This sets up a default deny (DROP) firewall for incoming connections, with all outbound connections allowed with state tracking.
As mentioned, the ufw framework is capable of doing anything that iptables can do. This is achieved by using several sets of rules files, which are nothing more than iptables-restore compatible text files. Fine-tuning ufw and/or adding additional iptables commands not offered via the ufw command is a matter of editing various text files:
After modifying any of the above files, activate the new settings with:
Insert ufw -h like this: