1

I have several sudo users on Ubuntu 16 PC. ufw is disabled on this PC now. I need to switch ufw on for sudouser1. I need to make following config:

1) allow all and any incoming and outgoing connections only from subnet (for example 123.44..) but for all ports and protocols

2a) allow outgoing all and any connections only to specified IP outside subnet

OR

2b) deny ANY connections with specified IP

I try it, but it seems I am absolutely dummy. Is it possible at all?

UPDATE:

I need it not for security reasons, as (thanks to Charles Green) sudo user may just switch off UFW. I need it for a bunch of programms which run on this PC. If it is impossible to do for one user, ok I am ready to do so for all.

UPDATE2

After my experiments I have:

CMT:~$ sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW       Anywhere                  
Anywhere                   DENY        21.110.11.57              
21.110.11.57               DENY        Anywhere                  
Anywhere                   DENY        21.110.0.0/16             
21.110.0.0/16              DENY        Anywhere                  
Anywhere (v6)              ALLOW       Anywhere (v6)

But the command: netstat -nputw

output:

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 1.1.1.1:1234       21.110.11.57     ESTABLISHED

What is wrong?

Improve this question
2
  • 2
    I believe that when UFW is present and configured, it operates for all processes, not just a single user. And since your user has sudo rights, they can bypass or reconfigure UFW... What re you really trying to accomplish?
    – Charles Green
    Dec 15, 2017 at 14:37
  • You can filter outbound traffic per user via iptables, but not with ufw. If you are running a server, and wish to limit incoming traffic, you may be able to configure the server or other tools
    – Panther
    Dec 15, 2017 at 15:18

1 Answer 1

Reset to default
1

Partially From: Whitelist IPs for ufw

1) Allow all connection from IP addresses

ufw allow from 10.10.0.1/16

replace with whatever subnet/IP you want

2b) block incoming traffic from IP

ufw deny from 10.10.0.1/16

replace with whatever IP/subnet you want

For outgoing traffic, check using ufw to block outgoing traffic to website

Simplified:

ufw deny out from any to 10.10.0.1

or, to allow out

ufw allow out from any to 10.10.0.1
Improve this answer
6
  • Thank you i will try now, but one question - I am bad in subnet masks if i need to restrict only first 2 octets then 10.10.*.* ?
    – zlon
    Dec 15, 2017 at 14:43
  • I also suck at networking, but from my knowledge of wildcards that's worth a shot
    – user8292439
    Dec 15, 2017 at 14:47
  • @NerdOfLinux - Nice answer, but these settings are system wide, not per user. See jodies.de/ipcalc?host=10.10.0.1&mask1=16&mask2= , so I am guessing 10.10.0.1/16
    – Panther
    Dec 15, 2017 at 15:32
  • OP stated: I am ready to do so for all.
    – user8292439
    Dec 15, 2017 at 15:33
  • That is a partial quote, the full quote is " If it is impossible to do for one user, ok I am ready to do so for all." It is not possible with ufw, but it is possible with iptables, up to the OP I guess. Change /24 to /16 and I think your answer is good to go.
    – Panther
    Dec 15, 2017 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .