LKNOG Wiki

In this exercise we will see examples of how to set up simple host protection using ufw to configure the iptables firewall. All the commands in this exercise need to be done as root. If you are not already root, start a root shell like this:

$ sudo -s
# 

note : In this lab session you don't have to install ufw as it comes default with ubuntu

# apt-get install ufw

This will install iptables as a dependency if it is not already installed.

Use the ufw status commands

# ufw status
Status: inactive

And iptables command

# iptables -L -n -v
Chain INPUT (policy ACCEPT 44579 packets, 8596K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 52080 packets, 4315K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 25720 packets, 2713K bytes)
 pkts bytes target     prot opt in     out     source               destination

The iptables output shows that the firewall is “permit everything” - there are no rules in any of the chains, and the “policy” of ACCEPT is the default if no rule matches.

When we enable the firewall, it's important we don't block ssh or we could lock ourselves out!

ufw may already know about some applications, including OpenSSH, so we can just apply the rule it knows about.

# ufw app list
Available applications:
  Apache
  Apache Full
  Apache Secure
  OpenSSH

Alow OpenSSH

# ufw allow OpenSSH
Rules updated
Rules updated (v6)

This policy allows SSH from any IP address. If that's not what you want, you could have added a more specific rule by hand.

Now let's go ahead and enable the firewall:

# ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y Firewall is active and enabled on system startup

# ufw status
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)

If you like, you can check the iptables ruleset again:

# iptables -L -n -v

… but this shows a long configuration over multiple screens. Buried in this you may be able to locate the rule which actually permits ssh:

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 /* 'dapp_OpenSSH' */

“ufw status” is much easier!

Let's try a simple firewall rule. Lets block everyone from ssh in to your ubuntu VM except for your host machine. Before adding the rule ask your neighbor to try ssh in to your Ubuntu VM. He should be able to log in.

Now add the following rules. Note that you have to give them in given sequence.

#ufw allow proto tcp from < IP of Your host machine >/32 to any port 22
Rule added

This rule is explained as you are allowing all tcp packets coming from your host machine to the port 22(SSH port)

Now add the following rule to deny packets from any other ip addresses to port 22

#ufw deny OpenSSH
Rules updated
Rules updated (v6)

Check the status

# ufw status
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    DENY        Anywhere
22/tcp                     ALLOW       <Your host IP address>/32
OpenSSH (v6)               DENY       Anywhere (v6)

Now ask your neighbor to ssh in to your VM

Finally, turn off ufw completely. This is useful for debugging problems, and for our labs we want to make sure that ufw is not going to get in the way of any other exercises.

# ufw disable
Firewall stopped and disabled on system startup
# ufw status
Status: inactive

If you are in a root shell, type “exit” to return to your normal user shell.