0

I have Ubuntu 18.04.3, running no server and want to protect my pc with a firewall. Now what is more simple than the program (g)ufw. I like the default settings Default: deny (incoming), allow (outgoing), deny (routed).

Now the first problem I have is that everytime the system boots ufw is inactive. I do not exactly understand what this means: is the default firewall also inactive or just the program ufw? I followed some online suggestions to have ufw enabled on boot, but they don't work.

The second problem is even worse. If I issue the command: sudo iptables -L, to have a manual look at my firewall rules, this is the output for the chain

INPUT:

Chain INPUT (policy DROP)

target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  255.255.255.255      anywhere            
ACCEPT     all  --  192.168.0.0/16       192.168.0.0/16      
ACCEPT     all  --  10.0.0.0/8           10.0.0.0/8          
ACCEPT     all  --  172.16.0.0/12        172.16.0.0/12       
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
ufw-before-logging-input  all  --  anywhere             anywhere            
ufw-before-input  all  --  anywhere             anywhere            
ufw-after-input  all  --  anywhere             anywhere            
ufw-after-logging-input  all  --  anywhere             anywhere            
ufw-reject-input  all  --  anywhere             anywhere            
ufw-track-input  all  --  anywhere             anywhere        

As you can see the default policy is DROP, which is good and as expected by setting ufw's default (deny incoming). But then look at the rules for INPUT. As I understand the rules goes from specific to general. So if the default is to drop input, you put some specific rules in place to allow the incoming traffic you do want. Now what is the first "specific" rule on input:

ACCEPT     all  --  anywhere             anywhere

meaning: yes, accept all traffic coming from anywhere going to anywhere and do so for all protocols. So while my ufw policy is dead simple: drop all incoming traffic, that policy is defeated by the very first rule that comes before that: allow everything incoming.

When I look at the chain OUTPUT

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

I find literally hundreds of rules of the sort:

ACCEPT     all  --  anywhere             193.37.254.14       

Why would that be? Does every destination I once connected gets its own rule, or what?

So, undoubtedly I misunderstand the inner workings of firewall and iptables, but that is why I want you to enlighten me.

  • Are you sure that you are using a firewall for the correct purpose? A default install of Ubuntu Desktop has no exploitable open ports. You have the power to install and uninstall ALL services that can bind to ports. – user535733 Jan 29 at 12:02
  • You mean I don't need a firewall? I never seen such recommendation before. To me it seems that my firewall would permit now everything, but just having a desktop and no server would mean it doesn't matter? – Rob Jan 29 at 12:10
  • Still I don't understand where my firewall settings come from. I did a fresh install of Ubuntu just a couple of weeks ago, and never fiddled with firewall settings ever before except by enabling gufw in its default configuration – Rob Jan 29 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.