I have Ubuntu 18.04.3, running no server and want to protect my pc with a firewall. Now what is more simple than the program (g)ufw. I like the default settings Default: deny (incoming), allow (outgoing), deny (routed).
Now the first problem I have is that everytime the system boots ufw is inactive. I do not exactly understand what this means: is the default firewall also inactive or just the program ufw? I followed some online suggestions to have ufw enabled on boot, but they don't work.
The second problem is even worse. If I issue the command: sudo iptables -L, to have a manual look at my firewall rules, this is the output for the chain
INPUT: Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- 255.255.255.255 anywhere ACCEPT all -- 192.168.0.0/16 192.168.0.0/16 ACCEPT all -- 10.0.0.0/8 10.0.0.0/8 ACCEPT all -- 172.16.0.0/12 172.16.0.0/12 ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere ufw-before-logging-input all -- anywhere anywhere ufw-before-input all -- anywhere anywhere ufw-after-input all -- anywhere anywhere ufw-after-logging-input all -- anywhere anywhere ufw-reject-input all -- anywhere anywhere ufw-track-input all -- anywhere anywhere
As you can see the default policy is DROP, which is good and as expected by setting ufw's default (deny incoming). But then look at the rules for INPUT. As I understand the rules goes from specific to general. So if the default is to drop input, you put some specific rules in place to allow the incoming traffic you do want. Now what is the first "specific" rule on input:
ACCEPT all -- anywhere anywhere
meaning: yes, accept all traffic coming from anywhere going to anywhere and do so for all protocols. So while my ufw policy is dead simple: drop all incoming traffic, that policy is defeated by the very first rule that comes before that: allow everything incoming.
When I look at the chain OUTPUT
Chain OUTPUT (policy ACCEPT) target prot opt source destination
I find literally hundreds of rules of the sort:
ACCEPT all -- anywhere 188.8.131.52
Why would that be? Does every destination I once connected gets its own rule, or what?
So, undoubtedly I misunderstand the inner workings of firewall and iptables, but that is why I want you to enlighten me.