UncomplicatedFirewall

Differences between revisions 96 and 97
Revision 96 as of 2013-04-25 17:13:13
Size: 10730
Editor: jdstrand
Comment:
Revision 97 as of 2013-10-18 20:49:28
Size: 9858
Editor: jdstrand
Comment:
Deletions are marked like this. Additions are marked like this.
Line 29: Line 29:
 * '''Ubuntu 8.04 LTS''': 0.16.2
Line 31: Line 30:
 * '''Ubuntu 11.10''': 0.30.1-2ubuntu1
Line 35: Line 33:
 * '''Ubuntu 13.10''': 0.33-0ubuntu4
Line 39: Line 38:
|| '''Feature'''   || '''8.04 LTS''' || '''10.04 LTS''' || '''11.10''' || '''12.04 LTS''' || '''12.10''' || '''13.04''' ||
|| default incoming policy (allow/deny) || yes || yes || yes || yes     || yes || yes ||
|| allow/deny incoming rules || yes || yes || yes         || yes || yes || yes ||
|| IPv6 || yes || yes             || yes^1^ || yes^1^     || yes^1^ || yes^1^ ||
|| status || yes || yes || yes || yes     || yes || yes ||
|| logging (on/off) || yes || yes || yes         || yes || yes || yes ||
|| extensible framework || yes || yes || yes || yes     || yes || yes ||
|| python 2.5 support || yes || yes || yes || yes || no || no ||
|| application integration || -- || yes || yes || yes || yes || yes ||
|| IPv4 rate limiting via 'limit' command || -- || yes || yes || yes || yes || yes ||
|| internationalization || -- || yes || yes || yes || yes || yes ||
|| multiport incoming rules || -- || yes || yes || yes || yes || yes ||
|| debconf/preseeding || -- || yes || yes || yes || yes || yes ||
|| default incoming policy (reject) || -- || yes || yes || yes || yes || yes ||
|| reject incoming rules || -- || yes || yes || yes || yes || yes ||
|| rule insertion || -- || yes || yes || yes || yes || yes ||
|| log levels || -- || yes || yes || yes || yes || yes ||
|| per rule logging || -- || yes || yes || yes || yes || yes ||
|| outgoing filtering (on par with incoming) || -- || yes || yes || yes || yes || yes ||
|| filtering by interface || -- || yes || yes || yes || yes || yes ||
|| bash completion || -- || yes || yes || yes || yes || yes ||
|| upstart support || -- || yes || yes || yes || yes || yes ||
|| improved reporting || -- || yes || yes || yes || yes || yes ||
|| reset command || -- || yes || yes || yes || yes || yes ||
|| rsyslog support || -- || yes || yes || yes || yes || yes ||
|| delete by rule number || -- || yes || yes || yes || yes || yes ||
|| python 2.6 support || -- || yes || yes         || yes || yes || yes ||
|| 'show listening' report || -- || -- || yes || yes
|| yes || yes ||
|| python 2.7 support || -- || -- || yes || yes || yes || yes ||
|| IPv6 rate limiting via 'limit' command || -- || -- || -- || -- || yes || yes ||
|| python 3.2 support || -- || -- || -- || -- || yes || yes ||
|| python 3.3 support || -- || -- || -- || -- || yes || yes ||
|| 'show added' report || -- || -- || -- || -- || yes || yes ||
|| '''Feature''' || '''10.04 LTS''' || '''12.04 LTS''' || '''12.10''' || '''13.04''' || '''13.10''' ||
|| default incoming policy (allow/deny) || yes || yes || yes || yes || yes ||
|| allow/deny incoming rules || yes || yes || yes || yes || yes ||
|| IPv6 || yes || yes^1^     || yes^1^ || yes^1^ || yes^1^ ||
|| status || yes || yes || yes || yes || yes ||
|| logging (on/off) || yes || yes || yes || yes || yes ||
|| extensible framework || yes || yes || yes || yes || yes ||
|| python 2.5 support || yes || yes || no || no || no ||
|| application integration || yes || yes || yes || yes || yes ||
|| IPv4 rate limiting via 'limit' command || yes || yes || yes || yes || yes ||
|| internationalization || yes || yes || yes || yes || yes ||
|| multiport incoming rules || yes || yes || yes || yes || yes ||
|| debconf/preseeding || yes || yes || yes || yes || yes ||
|| default incoming policy (reject) || yes || yes || yes || yes || yes ||
|| reject incoming rules || yes || yes || yes || yes || yes ||
|| rule insertion || yes || yes || yes || yes || yes ||
|| log levels || yes || yes || yes || yes || yes ||
|| per rule logging || yes || yes || yes || yes || yes ||
|| outgoing filtering (on par with incoming) || yes || yes || yes || yes || yes ||
|| filtering by interface || yes || yes || yes || yes || yes ||
|| bash completion || yes || yes || yes || yes || yes ||
|| upstart support || yes || yes || yes || yes || yes ||
|| improved reporting || yes || yes || yes || yes || yes ||
|| reset command || yes || yes || yes || yes || yes ||
|| rsyslog support || yes || yes || yes || yes || yes ||
|| delete by rule number || yes || yes || yes || yes || yes ||
|| python 2.6 support || yes || yes || yes || yes || yes ||
|| 'show listening' report ||
-- || yes || yes || yes || yes ||
|| python 2.7 support || -- || yes || yes || yes || yes ||
|| IPv6 rate limiting via 'limit' command || -- || -- || yes || yes || yes ||
|| python 3.2 support || -- || -- || yes || yes || yes ||
|| python 3.3 support || -- || -- || yes || yes || yes ||
|| 'show added' report || -- || -- || yes || yes || yes ||
Line 111: Line 110:
 * Ubuntu 8.04 LTS (Hardy Heron)
  * [[https://help.ubuntu.com/8.04/serverguide/C/firewall.html|Server Guide - Firewall]]
  * [[http://manpages.ubuntu.com/manpages/hardy/en/man8/ufw.8.html|ufw manual]]
Line 119: Line 114:

 * Ubuntu 11.10 (Oneiric Ocelot)
  * [[https://help.ubuntu.com/11.10/serverguide/C/firewall.html|Server Guide - Firewall]]
  * [[http://manpages.ubuntu.com/manpages/oneiric/en/man8/ufw.8.html|ufw manual]]
  * [[http://manpages.ubuntu.com/manpages/oneiric/en/man8/ufw-framework.8.html|ufw framework manual]]
Line 140: Line 130:
 * Ubuntu 13.10 (Saucy Salamander)
  * [[https://help.ubuntu.com/13.10/serverguide/C/firewall.html|Server Guide - Firewall]]
  * [[http://manpages.ubuntu.com/manpages/saucy/en/man8/ufw.8.html|ufw manual]]
  * [[http://manpages.ubuntu.com/manpages/saucy/en/man8/ufw-framework.8.html|ufw framework manual]]

Introduction

The Linux kernel in Ubuntu provides a packet filtering system called netfilter, and the traditional interface for manipulating netfilter are the iptables suite of commands. iptables provide a complete firewall solution that is both highly configurable and highly flexible.

Becoming proficient in iptables takes time, and getting started with netfilter firewalling using only iptables can be a daunting task. As a result, many frontends for iptables have been created over the years, each trying to achieve a different result and targeting a different audience.

The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls. ufw provides a framework for managing netfilter, as well as a command-line interface for manipulating the firewall. ufw aims to provide an easy to use interface for people unfamiliar with firewall concepts, while at the same time simplifies complicated iptables commands to help an adminstrator who knows what he or she is doing. ufw is an upstream for other distributions and graphical frontends.

UFW in Ubuntu

Ubuntu 8.04 LTS introduced ufw, and it is available by default in all Ubuntu installations after 8.04 LTS.

Available Versions in supported versions of Ubuntu

  • Ubuntu 10.04 LTS: 0.30pre1-0ubuntu2

  • Ubuntu 12.04 LTS: 0.31.1-1

  • Ubuntu 12.10: 0.33-0ubuntu2.1

  • Ubuntu 13.04: 0.33-0ubuntu3

  • Ubuntu 13.10: 0.33-0ubuntu4

Features

ufw has the following features:

Feature

10.04 LTS

12.04 LTS

12.10

13.04

13.10

default incoming policy (allow/deny)

yes

yes

yes

yes

yes

allow/deny incoming rules

yes

yes

yes

yes

yes

IPv6

yes

yes1

yes1

yes1

yes1

status

yes

yes

yes

yes

yes

logging (on/off)

yes

yes

yes

yes

yes

extensible framework

yes

yes

yes

yes

yes

python 2.5 support

yes

yes

no

no

no

application integration

yes

yes

yes

yes

yes

IPv4 rate limiting via 'limit' command

yes

yes

yes

yes

yes

internationalization

yes

yes

yes

yes

yes

multiport incoming rules

yes

yes

yes

yes

yes

debconf/preseeding

yes

yes

yes

yes

yes

default incoming policy (reject)

yes

yes

yes

yes

yes

reject incoming rules

yes

yes

yes

yes

yes

rule insertion

yes

yes

yes

yes

yes

log levels

yes

yes

yes

yes

yes

per rule logging

yes

yes

yes

yes

yes

outgoing filtering (on par with incoming)

yes

yes

yes

yes

yes

filtering by interface

yes

yes

yes

yes

yes

bash completion

yes

yes

yes

yes

yes

upstart support

yes

yes

yes

yes

yes

improved reporting

yes

yes

yes

yes

yes

reset command

yes

yes

yes

yes

yes

rsyslog support

yes

yes

yes

yes

yes

delete by rule number

yes

yes

yes

yes

yes

python 2.6 support

yes

yes

yes

yes

yes

'show listening' report

--

yes

yes

yes

yes

python 2.7 support

--

yes

yes

yes

yes

IPv6 rate limiting via 'limit' command

--

--

yes

yes

yes

python 3.2 support

--

--

yes

yes

yes

python 3.3 support

--

--

yes

yes

yes

'show added' report

--

--

yes

yes

yes

  1. IPv6 enabled by default

Basic Usage

Getting started with ufw is easy. For example, to enable firewall, allow ssh access, enable logging, and check the status of the firewall, perform:

$ sudo ufw allow ssh/tcp
$ sudo ufw logging on
$ sudo ufw enable
$ sudo ufw status
Firewall loaded

To                         Action  From
--                         ------  ----
22:tcp                     ALLOW   Anywhere

This sets up a default deny (DROP) firewall for incoming connections, with all outbound connections allowed with state tracking.

Advanced Functionality

As mentioned, the ufw framework is capable of doing anything that iptables can do. This is achieved by using several sets of rules files, which are nothing more than iptables-restore compatible text files. Fine-tuning ufw and/or adding additional iptables commands not offered via the ufw command is a matter of editing various text files:

  • /etc/default/ufw: high level configuration, such as default policies, IPv6 support and kernel modules to use

  • /etc/ufw/before[6].rules: rules in these files are evaluated before any rules added via the ufw command

  • /etc/ufw/after[6].rules: rules in these files are evaluated after any rules added via the ufw command

  • /etc/ufw/sysctl.conf: kernel network tunables

  • /var/lib/ufw/user[6].rules or /lib/ufw/user[6].rules (0.28 and later): rules added via the ufw command (should not normally be edited by hand)

  • /etc/ufw/ufw.conf: sets whether or not ufw is enabled on boot, and in 9.04 (ufw 0.27) and later, sets the LOGLEVEL

After modifying any of the above files, activate the new settings with:

$ sudo ufw disable
$ sudo ufw enable

More Information

UncomplicatedFirewall (last edited 2023-10-18 01:29:55 by sbeattie)