Benjamin Diedrichsen
78 lines
2.6 KiB
Markdown
78 lines
2.6 KiB
Markdown
# armor-ufw
|
|
|
|
**Activate UFW (Uncomplicated Firewall)**
|
|
|
|
## Purpose
|
|
|
|
This cube configures and enables UFW, a user-friendly firewall management tool for Linux systems, providing basic protection against unauthorized network access.
|
|
|
|
## What is UFW?
|
|
|
|
UFW (Uncomplicated Firewall) is a frontend for `iptables` designed to make firewall configuration simple and accessible. It provides:
|
|
|
|
- **Easy-to-understand syntax**: Commands like `ufw allow ssh` instead of complex iptables rules
|
|
- **Default deny policy**: Blocks all incoming connections except those explicitly allowed
|
|
- **Connection tracking**: Automatically handles related and established connections
|
|
- **Application profiles**: Pre-configured rules for common services
|
|
|
|
Think of UFW as a security gate for your server - it controls which network traffic is allowed in and out.
|
|
|
|
## What This Cube Does
|
|
|
|
1. Configures UFW to allow SSH connections (port 22)
|
|
- Ensures you don't lock yourself out when enabling the firewall
|
|
2. Optionally allows HTTP traffic (port 80) based on the `ALLOW_HTTP` parameter
|
|
3. Enables the firewall with the configured rules
|
|
|
|
## Configuration
|
|
|
|
### Parameters
|
|
|
|
- **ALLOW_HTTP** (boolean, default: `true`)
|
|
- Allow incoming HTTP traffic on port 80
|
|
- Set to `false` if you're only using HTTPS or don't need web traffic
|
|
|
|
## Dependencies
|
|
|
|
- **apt:essentials** - Required for basic system tools
|
|
|
|
## Security Notes
|
|
|
|
**Important**: This cube automatically allows SSH to prevent lockouts. If you need to allow additional services, you can run:
|
|
|
|
```bash
|
|
sudo ufw allow [port number]/[protocol]
|
|
sudo ufw allow [service-name]
|
|
```
|
|
|
|
Examples:
|
|
- `sudo ufw allow 443/tcp` - Allow HTTPS
|
|
- `sudo ufw allow 3000/tcp` - Allow custom application port
|
|
- `sudo ufw allow https` - Allow HTTPS by service name
|
|
|
|
## Post-Installation
|
|
|
|
Check firewall status:
|
|
```bash
|
|
sudo ufw status verbose
|
|
sudo ufw status numbered
|
|
```
|
|
|
|
Common UFW commands:
|
|
- Delete rule: `sudo ufw delete [rule number]`
|
|
- Disable firewall: `sudo ufw disable`
|
|
- Reset to defaults: `sudo ufw reset`
|
|
|
|
## UFW File Locations
|
|
|
|
UFW rules are stored in the `/etc/ufw` directory:
|
|
|
|
- `/etc/ufw/user.rules` - Custom rules added via the `ufw` command
|
|
- `/etc/ufw/before.rules` - Rules processed before user rules (high priority)
|
|
- `/etc/ufw/after.rules` - Rules processed after user rules (exceptions)
|
|
- `/etc/ufw/sysctl.conf` - Kernel network parameters (e.g., packet forwarding)
|
|
- `/etc/ufw/applications.d/` - Application profiles for common services
|
|
- `/etc/default/ufw` - Global UFW settings and default policies
|
|
|
|
Understanding these locations is helpful for troubleshooting, manual edits, or backing up your firewall configuration.
|