Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Firstly, for a home PC, behind a router isit important to install/configure a firewall?

If so, how do I do it? I have lamp-server installed as I'm a web developer. I may want my other PC's on LAN to access my files or web pages, ssh in (maybe in the future), but not from outside. How can I configure this? From work, I learnt that I keep blocking myself all the time, also denyhosts is useful for bruteforce hacking. But problem is I am not a System Admin so I keep blocking myself (including others) instead. Maybe gufw + denyhosts maybe a good start

share|improve this question
    
Your router/dsl modem should by default block any http port from the internet, you have to set a port forward to enable internet access to your http server - I doubt you need a firewall if you only have a LAN-only service for a home pc. Depends on the level of security you wish to have. –  medigeek Dec 17 '11 at 10:16

2 Answers 2

up vote 1 down vote accepted

Your question if fairly broad and I will try to answer some parts.

A firewall can be helpful for you, and you already know what you want - allow clients on your LAN and deny everyone else.

So, first thing, your router. Disable UPnP and do not forward port 80 (http) or 443 (https). If you need , you can forward SSH (port 22).

On the server you can then significantly increase ssh security if you use ssh keys (to log in) and disable passwords.

Ubuntu wiki ssh keys

denyhosts can be helpful, but the lockouts are a hassle. You can whitelist an IP or ip range.

For some advice on denyhost see http://www.cyberciti.biz/faq/block-ssh-attacks-with-denyhosts/ or the denyhosts documentation.

Now for your firewall , you can easily use ufw or if you want a graphical front end gufw.

Assuming you want just HTTP and SSH (change 192.168.0.0/24 to your LAN):

sudo ufw enable
sudo ufw allow from 192.168.0.0/24 to any port 80
sudo ufw allow from 192.168.0.0/24 to any port 443 

# for ssh from anywhere
sudo ufw allow ssh

# for ssh from your lan only
sudo ufw allow from 192.168.0.0/24 to any port 22

See also Ubuntu wiki UFW

share|improve this answer

If you use your home machine for developing anything for a client, or have sensitive information on there it is worth looking at the benefits.

As @medigeek said, it may be overkill for you, as your ISP's router/modem will give some protection. It may by default deny all inbound until you open a route in.

However - if you take the usual security assumption that at some point someone or something malicious may get past that router (through an unpatched or zero-day vulnerability, a misconfiguration, via your file server or web server etc) what protection do you have, and how much do you want?

I generally advise anyone who even does online banking to have a layered approach:

  • deny all inbound on the router
  • host firewall (whether they are on Windows, Linux or other)
  • look at DMZ's if you run a range of servers at home
  • ensure all accessible machines are patched up to date

These are all simple options which require very little maintenance for a standard home setup with <10 servers or PC's

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.