Where Can One Find Guidance for Managing a Firewall?

Question

I have been searching to find information regarding managing firewall rules, but have found nothing.

I wish to be clear: I am NOT trying to learn the commands to modify iptables or ufw for example, to add a rule, add a table, etc. That stuff can be found everywhere.

Instead, what I am trying to find is guidance on which rules I ought to have; or, some sample sets of tables and rules.

The problem is that I have no idea which programs need – or may need – which ports to be open to which protocols and from/to which ip addresses. So, I am mentally paralyzed: I currently keep everything wide open simply out of fear of causing some programs to stop working. I know this is not a good thing to do, but I do not have the knowledge to do otherwise.

Similarly, suppose I install a new program from the software store: How do I know what modifications, if any, I need to make to the existing iptables? When installing a new program I have never seen any of them provide documentation explaining what that program’s needs/expectations are regarding ports/protocols, etc.

I’ve thought, Well, I could just close down everything, and then just see what doesn’t work, and then make the necessary rules. But, that seems very tedious and inefficient. Besides, when I find a program that doesn’t work, I still don’t know the wise course of action: Do I simply open the port, or should I open the port for only a certain protocol (how would I know which one?), or do I need to also restrict the ip addresses involved, etc.?

Thus, I was looking online to try to find guidance on how to know which rules I ought to have, but I have found nothing that helps. Every site I’ve gone to seems to assume that I already know exactly which rules I need, and that I simply need to be shown how to use the terminal to create those rules.

So, here I sit: I know how to create the rules, but I don’t know which rules I ought to be creating. It’s kind of like, I’ve been shown how to use all the power tools, and now I’ve been told to use those tools to build a jet plane – Despite having been shown how to use each power tool, I still wouldn’t know where to start.

Well, I am hoping someone on here will be able to point me to a source with up-to-date information that will help a firewall novice who knows very little about how programs work figure out the rules that are needed for the programs he has on his system to achieve different levels of security.

Answer 1

Here's what I do...

I use gufw to manage my firewall. It's a GUI for ufw.

sudo apt-get update
sudo apt-get install gufw

If I have a program that doesn't work, and I suspect it's a port issue, I turn off the firewall in gufw. If the program now works, then I know there's a port (on the computer) that needs to be opened. Remember that there are also ports on your router that may need to be opened, or forwarded to a specific host on your internal network.

Then I turn the firewall back on via gufw, and then I switch to the Report window, and I watch it while I run the application in question, and the Report window will tell you which port/protocol are blocked in real time.

Then I Google the "application name", and "ports to open", to see if there are other ports besides the ones that I observed, that also need to be opened.

Then I switch to the Rules window and try to create a rule that really provides only a narrow window for things to get through, and by that I mean, I specific only 1 of {TCP|UDP|ALL), a limited range of ports, and specific IP addresses of the source/target. I give the new rule a name that allows me to review it later and remember why the rule exists.