5

What is the easiest way to make it so that the only way anyone could access the ssh or ftp for my ubuntu machine is to be on a certain ip address?

1
8

Ubuntu Firewall (ufw).

See if Ubuntu Firewall is active:

$ sudo ufw status

If it's inactive, enable it:

$ sudo ufw enable

Allow SSH connections from a specific IP address:

$ sudo ufw allow from 123.123.123.123 to any port 22 proto tcp

Allow FTP connections

$ sudo ufw allow from 123.123.123.123 to any port 21 proto tcp

View firewall rules:

$ sudo ufw status

Delete above SSH rule:

$ sudo ufw delete allow from 123.123.123.123 to any port 22 proto tcp

Disable Ubuntu Firewall:

$ sudo ufw disable
5
  • UFW is Uncomplicated FireWall. UFW isn't "active" it's a program one installs to write iptables rules more simply, a varnish if you will, that configures the netfilter firewall. ufw enable tells ufw to enable the firewall, for example. – pbhj Jan 15 '18 at 22:51
  • 1
    Ah, ok. Good to know. I haven't looked at the documentation lately, but I've always called it "Ubuntu Firewall". I don't think the author himself is too fussed about what UFW stands for: "What does it mean? It has come to mean 'Uncomplicated Firewall', but you can change it to something more suitable if you want. If you like it, you might pick 'Universal Firewall', or 'Ultimate Firewall'. If you are not a fan, perhaps 'Unbearable Firewall'. Have fun!" – Vanessa Deagan Jan 17 '18 at 10:48
  • How do I allow all connections from my local network? I have a dynamic ip so if I did the normal ip address it would eventually change and I'd be locked out. I've also tried using a DNS that points to my dyn ip but it gave an error "Bad source address". – kevCAI Jan 17 '18 at 15:52
  • 1
    If your LAN is 192.168.0.x, you can allow from all LAN addresses using: sudo ufw allow from 192.168.0.0/24 to any port 22 proto tcp - this is assuming your SSH server is on the LAN and you're trying to access it using the LAN IP address, not some external IP address that is forwarded to the LAN address. – Vanessa Deagan Jan 19 '18 at 10:44
  • @kevCAI you can put a netblock in, so have the allowed IP address swapped for your ISPs netblock; often that info can be found from whois $ipaddress where $ipaddress is your own IP. – pbhj Jan 21 '18 at 20:52
4

The easiest way is using the firewall. DigitalOcean has a great tutorial on configuring ufw.

First make sure ufw is enabled, if not enable it:

sudo ufw status
sudo ufw enable

The relevant command for ssh/ftp from one address would be

sudo ufw allow from 15.15.15.15 to any port 22
sudo ufw allow from 15.15.15.15 to any port 21

Port 22 is the defaut for SSH, 21 is the default for FTP. You can replace 15.15.15.15 by either a subnet you want or a specific IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.