ansiblings/packages/cubes-core/cubes/armor/ufw

armor-ufw

Activate UFW (Uncomplicated Firewall)

Purpose

This cube configures and enables UFW, a user-friendly firewall management tool for Linux systems, providing basic protection against unauthorized network access.

What is UFW?

UFW (Uncomplicated Firewall) is a frontend for iptables designed to make firewall configuration simple and accessible. It provides:

• Easy-to-understand syntax: Commands like ufw allow ssh instead of complex iptables rules
• Default deny policy: Blocks all incoming connections except those explicitly allowed
• Connection tracking: Automatically handles related and established connections
• Application profiles: Pre-configured rules for common services

Think of UFW as a security gate for your server - it controls which network traffic is allowed in and out.

What This Cube Does

1. Configures UFW to allow SSH connections (port 22)
   • Ensures you don't lock yourself out when enabling the firewall
2. Optionally allows HTTP traffic (port 80) based on the ALLOW_HTTP parameter
3. Enables the firewall with the configured rules

Configuration

Parameters

• ALLOW_HTTP (boolean, default: true)
  • Allow incoming HTTP traffic on port 80
  • Set to false if you're only using HTTPS or don't need web traffic

Dependencies

• apt:essentials - Required for basic system tools

Security Notes

Important: This cube automatically allows SSH to prevent lockouts. If you need to allow additional services, you can run:

sudo ufw allow [port number]/[protocol]
sudo ufw allow [service-name]

Examples:

• sudo ufw allow 443/tcp - Allow HTTPS
• sudo ufw allow 3000/tcp - Allow custom application port
• sudo ufw allow https - Allow HTTPS by service name

Post-Installation

Check firewall status:

sudo ufw status verbose
sudo ufw status numbered

Common UFW commands:

• Delete rule: sudo ufw delete [rule number]
• Disable firewall: sudo ufw disable
• Reset to defaults: sudo ufw reset

UFW File Locations

UFW rules are stored in the /etc/ufw directory:

• /etc/ufw/user.rules - Custom rules added via the ufw command
• /etc/ufw/before.rules - Rules processed before user rules (high priority)
• /etc/ufw/after.rules - Rules processed after user rules (exceptions)
• /etc/ufw/sysctl.conf - Kernel network parameters (e.g., packet forwarding)
• /etc/ufw/applications.d/ - Application profiles for common services
• /etc/default/ufw - Global UFW settings and default policies

Understanding these locations is helpful for troubleshooting, manual edits, or backing up your firewall configuration.