1

I have an ubuntu server that I access through SSH. I've changed standart port (22) to something else. I want to enable ufw on this machine. However, I'm afraid of the possibility of the following scenario occuring: as soon as I enable ufw, it'll start with default settings blocking connections and kicks me from server, especially since I'm connecting through non-standart port. Will that happen? Should I prepare some configuration first or start ufw right away? SSH is the only way of accessing my server, so loosig this due to firewall would be a disaster.

I also have some applications using some ports for UDP and TCP connections. Will these ports be automatically blocked after I enable ufw? Will I need to add exceptions for them after enabling it?


I've probably found what I wanted, but I need a confirmation from somebody.

I haven't enabled ufw yet, but I've ran some configuration commands. First I did sudo ufw ssh Second sudo ufw my_new_ssh_port_here

Then I had a look at /lib/ufw/user.rules

This is part of the file:

### RULES ###

### tuple ### allow any 22 0.0.0.0/0 any 0.0.0.0/0 in
-A ufw-user-input -p tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp --dport 22 -j ACCEPT

### tuple ### allow any 1111 0.0.0.0/0 any 0.0.0.0/0 in
-A ufw-user-input -p tcp --dport 1111 -j ACCEPT
-A ufw-user-input -p udp --dport 1111 -j ACCEPT

### END RULES ###

Have I set it up to allow ssh connection through my new port successfully? Is it safe to start now or do I need to configure anything else?

I'm still not sure, because sudo ufw show raw doesn't seem to show anything helpful and sudo ufw status verbose still shows Status: inactive only

  • I think you can still create ufw passthroughs, even while it's off. Try sudo ufw yourport to allow it and then enable firewall. I recommend experimenting either by putting SSH back to 22 for now and enabling the passthrough for your other apps. Remember, outgoing connections shouldn't get blocked, so if your apps are connecting somewhere else, you'll be fine. – TheWanderer Oct 5 '15 at 0:03
  • @Zacharee1 Wouldn't the syntax be sudo ufw allow yourport? – Charles Green Oct 5 '15 at 0:29
  • @CharlesGreen Probably, but just putting the port there has always worked to allow it for me. Aliases maybe? – TheWanderer Oct 5 '15 at 0:30
  • Pretty certain ufw does transparently behind the scenes permit RELATED and ESTABLISHED connection traffic for already existing connections through when you turn it on. Make sure to permit more future port 22 for top though or you may lose SSH access – Thomas Ward Oct 5 '15 at 1:04
0

Ya. It may. Based on the default configurations. You can check the present configuration by using the following command sudo ufw show raw. The command will show the configuration of all policy's rules in iptable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.