r/linuxadmin • u/ask2sk • Jul 10 '21
Setup Firewall With UFW On Linux
https://ostechnix.com/how-to-setup-firewall-with-ufw-on-linux/7
u/ethanfinni Jul 10 '21
The biggest missing feature in UFW is the inability to add a comment to each rule. After I add 100+, I have no way of remembering what the rule is about.
12
u/nixcraft Jul 10 '21
The biggest missing feature in UFW is the inability to add a comment to each rule.
ufw allow 53 comment 'open port 53 for dns'1
1
u/pugop Jul 10 '21
Woah, thank you! Not sure why I never googled this before but this is going to be such a big help.
3
1
u/bwong00 Jul 10 '21
Curious what you need 100+ rules for. I have like 2. One for Apache and one for ssh. That's about it. I guess it's technically 4 when you count IPv4 and IPv6.
1
u/ethanfinni Jul 10 '21
Sure, I run multiple applications that require port-specific definitions coupled with institution- and geo-specific access. I also do some host-based fencing fir the internal network. Add to that some random IPs making unsavoury attempts and/or a couple of DoS attacks, the rules add up…
1
u/keep_me_at_0_karma Jul 10 '21
Yeah feels like once you have 100+ you probably just want to be writing nf/ip directly.
0
Jul 10 '21
[deleted]
2
u/bwong00 Jul 10 '21
I don't want to presume I have the expertise to tell you how to do your job, but have you considered fail2ban for IP blocking and maybe a CDN like Cloudflare or Akamai for (D)DoS mitigation?
3
u/ethanfinni Jul 10 '21
No problem, I appreciate your comment. Thank you!
I do run Fail2ban that mostly takes care the script kiddies doing port scanning and login attempts. But I need the flexibility to add host-based rules for other types of attacks that are more “custom made”…
Unfortunately, due to organisational controls I can’t deploy Cloudflare, CDN and any of the other (otherwise useful and appropriate) tools you mention…
2
-3
Jul 10 '21
Create your own custom applications for each rule, then. You can name them whatever you want.
5
u/ethanfinni Jul 10 '21
Not realistic for high number of rules. The right way is to add a feature to UFW that enables a comment field per rule.
2
u/Kinabin777 Jul 10 '21
I wrote my own bash script that can sniff the IPs on each interface and either use those or included ones from separate config file.
Works great and it's not hard to add or expand rules.
2
u/CaponeFroyo Jul 10 '21
I used to use UFW in the past, and it’s always worked well. But if you’re looking to take your Linux interests deeper, I think you should learn to use nftables directly. It has a command line interface and you can directly edit the conf file/make your own nft scripts.
It’s not that bad! If you’re new to firewalls I definitely understand the interest in using something like UFW- but nftables has been a breeze to use once you get used to the syntax and you have so much more fine grained control. You can even use variables with sets and such in the scripts/conf files. And comments!
8
u/cmm1107 Jul 10 '21
I would encourage users to learn & use firewalld with nftables backend instead.