H5A7N

                Is there a lunch or something..
                Stargate, 1994, 0:08:18

UFW
---

UFW {Uncomplicated Firewall) is an interface to iptables [1].

Every change seems to be permissive.

There is nothing to configure but the rules for which services are allowed to receive incoming connections [2].

UFW can allow access to a service but reject connections if it exceeds six per 30 seconds from the same origin IP address [2].

gufw — ufw GUI (compare gufw profiles with firewallD zones).

Install
.......

  $ sudo apt-get install ufw gufw
  $ sudo ufw status verbose
  Status: inactive

Defaults
........

1. deny all incoming connections
2. allow all outgoing connections.

  $ sudo ufw default deny incoming
  $ sudo ufw default allow outgoing

Allow service
.............

  $ sudo ufw allow ssh
  Rule added
  Rule added (v6)

Allow port
..........

  $ sudo ufw allow 22

Enable firewall after SSH hole is created.

  $ sudo ufw enable
  Firewall is active and enabled on system startup
  $ sudo ufw status verbose
  Status: active
  Logging: on (low)
  Default: deny (incoming), allow (outgoing), disabled (routed)
  New profiles: skip

Allow HTTP, HTTPS

  $ sudo ufw allow http
  $ sudo ufw allow https

or

  $ sudo ufw allow 80
  $ sudo ufw allow 443

Narrowing access

  $ sudo ufw allow 21/tcp
  $ sudo ufw allow 5000:6000/tcp
  $ sudo ufw allow 5000:6000/udp
  $ sudo ufw allow from 10.0.2.100
  $ sudo ufw allow from 10.0.2.0/24

Only on port 22

  $ sudo ufw allow from 10.0.2.100 to any port 22
  $ sudo ufw allow from 10.0.2.0/24 to any port 22

List interfaces
...............

  $ ip a

MySQL database server (port 3306) to listen for connections on the private network interface enp0s8:

  $ sudo ufw allow in on enp0s8 to any port 3306

Deny within created hole:

  $ sudo ufw deny http
  $ sudo ufw deny from 10.0.2.100

Delete rule
...........

  $ sudo ufw status numbered

  Numbered Output:
  Status: active

       To                         Action      From
       --                         ------      ----
  [ 1] 22                         ALLOW IN    10.0.2.0/24
  [ 2] 80                         ALLOW IN    Anywhere

By number:

  $ sudo ufw delete 2

By actual rule:

  $ sudo ufw delete allow http
  $ sudo ufw delete allow 80

Disable firewall
................

  $ sudo ufw disable

Reset firewall
..............

  $ sudo ufw reset

Disable ping
............

Edit /etc/ufw/before.rules:

  # ok icmp codes
  -A ufw-before-input -p icmp --icmp-type destination-unreachable -j DROP
  -A ufw-before-input -p icmp --icmp-type source-quench -j DROP
  -A ufw-before-input -p icmp --icmp-type time-exceeded -j DROP
  -A ufw-before-input -p icmp --icmp-type parameter-problem -j DROP
  -A ufw-before-input -p icmp --icmp-type echo-request -j DROP

Dry Run
.......

  --dry-run

Do not make any changes. Expected results are in output [4].

Loki/Freya
..........

Exists on Elementary OS only [5].

  Settings -> Security & Privacy -> Firewall -> On

..but want to block incoming vnc traffic on ports 5801, 5901, and 6001
..
..outgoing rule rule for DNS.

    Action: Allow
    Protocol: UDP
    Direction: Out
    Ports: 53

Profiles [6]
............

Application profile commands:
  allow <app_name>                    activate [7]
  app list                            list application profiles
  app info <app_name>                 show information on PROFILE
  app update <app_name>               update PROFILE
  app update --add-new <app_name>|all
  app default ARG                     set default application policy

Example

  $ sudo ufw app list
  Available applications:
    CUPS
    OpenSSH
  $ sudo ufw app info OpenSSH
  Profile: OpenSSH
  Title: Secure shell server, an rshd replacement
  Description: OpenSSH is a free implementation
               of the Secure Shell protocol.
  Port:        22/tcp

Creating profile

It's actually all there in the manpage under the "Application Integration" section [7].

In /etc/ufw/applications.d create file

Example

  [puppet]
  title=puppet configuration manager
  description=Puppet Open Source from http://www.puppetlabs.com/
  ports=80,443,8140/tcp

  [AMANDA]
  title=AMANDA Backup
  description=AMANDA the Advanced Maryland Automatic Network Disk Archiver
  ports=10080

VNC
...

Desktop Sharing

  Allow other users to view your desktop
  Allow other users to control your desktop
  Require the user to enter password

Encryption

  sudo apt install dconf-editor
  org -> gnome -> desktop -> remote-access
    require-encryption [FALSE]

Look for incoming VNC connections

  netstat -an | grep ESTABLISHED | grep ":5900" [8]

GUFW FAQ
--------

  $ cat /usr/share/gufw/gufw/gufw/view/gufw.py

Getting started

An uncomplicated way to manage your firewall, powered by ufw. Easy, simple, nice and useful! :)

Basic

If you are a normal user, you will be safe with this setting (Status=On, Incoming=Deny, Outgoing=Allow). Remember to append allow rules for your P2P apps:

  Status   [     [ON]]
  Incoming [ Deny  |v]
  Outgoing [ Allow |v]

You can rename your profiles with just 2 clicks on them:

  Profile: > Home <
            Public
            Office

The Rule Name will help you to identify your rules in the future:

  < My Transmission Port >

How to autostart Gufw with the system?

You do not need it. After you do all of the changes in Gufw, the settings are still in place until the next changes.

Why is Gufw disabled by default?

By default, the firewall does not open ports to the outside world.

Some rules are added by themselves?

Well, the behaviour is such that when you change or import a profile, or when you edit a rule, Gufw will add that rule again, then ufw re-adds that rule for IPv4 and IPv6.

What is Allow, Deny, Reject and Limit?

  Allow: Will allow traffic.
  Deny: Will deny traffic.
  Reject: Will deny traffic and will inform that it has been rejected.
  Limit: Will deny traffic if an IP tried several connections.

I see some rules in all profiles

All the ufw rules will be appear in all profiles.

What do I see in the Listening Report?

The ports on the live system in the listening state for TCP and the open state for UDP.

I want even more!

You'll find more information in the community documentation :)

Links
-----

1. How To Set Up a Firewall with UFW on Ubuntu 14.04

  https://www.digitalocean.com/community/tutorials
        /how-to-set-up-a-firewall-with-ufw-on-ubuntu-14-04

2. Comparing and contrasting Uncomplicated Firewall and FirewallD

  https://ctrl.blog/entry/ufw-vs-firewalld

3. UFW

  https://help.ubuntu.com/community/UFW

4. https://www.linux.com/learn/introduction-uncomplicated-firewall-ufw

5. https://www.linux.com/learn/get-know-elementary-os-freya-firewall-tool

6. http://landoflinux.com/linux_ufw_firewall.html

7. https://askubuntu.com/questions/409013
         /how-do-you-create-an-app-profile-for-ufw

8. Is it possible to find out if a VNC connection is active

  http://stackoverflow.com/questions/2271997
       /is-it-possible-to-find-out-if-a-vnc-connection-is-active

9. http://ubuntuhandbook.org/index.php
        /2016/07/remote-access-ubuntu-16-04/
