2

I am setting up ufw using ansible on a remote ubuntu server. I am initially setting up ufw with ufw enable policy allow to enable ssh access. After that I'm doing ufw allow from x.x.x.x to any port 22 to allow ssh from a specific port

After that I fire in the command ufw deny ssh to deny ssh from all other places except the above IP.

I then restart ufw services

But, this does not prevent ssh at all. I'm able to access the server from every place via ssh.

How can I block all ports after settings ufw policy to allow.

7
  • 2
    "Rule ordering is important and the first match wins. Therefore when adding rules, add the more specific rules first with more general rules later." - man ufw Jul 11, 2016 at 11:33
  • @steeldriver: yes i did that. ssh from a specific IP was added first. Then the deny rule was added.
    – Ubuntuser
    Jul 11, 2016 at 12:20
  • 1
    What is ufw enable policy allow though? I don't see mention of that syntax in the manpage. If you set the default incoming policy to allow first, that would take precedence. Jul 11, 2016 at 12:31
  • sorry, that option is specific to ansible. it enables incoming by default. i have to do that because ufw immediately blocks ssh when enabled.
    – Ubuntuser
    Jul 14, 2016 at 9:16
  • I'm not familiar with Ansible, but with regular ufw the way around that is to specify all the the rules required to allow your essential services before enabling ufw Jul 14, 2016 at 11:00

1 Answer 1

0

I would configure ufw this way:

first, make sure ufw is inactive so you do not cut off yourself

sudo ufw status # should say inactive if not, turn it off

than configure (note that order is critical):

sudo ufw default deny incoming    # applied at the end of the last rule
sudo ufw default allow outgoing
sudo ufw allow from x.x.x.x to any 22

these rules should do it as the only ssh from your specified IP is allowed.

then turn on the firewall by:

sudo ufw enable
2
  • 1
    You may also note that the order of the commands is important.
    – user68186
    Oct 14, 2017 at 21:59
  • Ufw allow ipv4 needs to be at the top then use ufw deny all ssh , it reads line one and works it's way down, if it reads deny before allow it will deny everything, but if you ask it to allow an IP before it denies everything then one will be allowed through
    – user610658
    Apr 3, 2018 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .