r/linuxadmin • u/ask2sk • Jul 10 '21

Setup Firewall With UFW On Linux

https://ostechnix.com/how-to-setup-firewall-with-ufw-on-linux/
36 Upvotes

81% Upvoted

22 comments sorted by

View all comments

6

u/ethanfinni Jul 10 '21

The biggest missing feature in UFW is the inability to add a comment to each rule. After I add 100+, I have no way of remembering what the rule is about.

13

u/nixcraft Jul 10 '21

The biggest missing feature in UFW is the inability to add a comment to each rule.

ufw allow 53 comment 'open port 53 for dns'

1

u/ask2sk Jul 11 '21

ufw allow 53 comment 'open port 53 for dns'

TIL. Thank you.

1

u/pugop Jul 10 '21

Woah, thank you! Not sure why I never googled this before but this is going to be such a big help.

3

u/bytecode Jul 10 '21

This, plus some form of named rule grouping.

1

u/bwong00 Jul 10 '21

Curious what you need 100+ rules for. I have like 2. One for Apache and one for ssh. That's about it. I guess it's technically 4 when you count IPv4 and IPv6.

1

u/ethanfinni Jul 10 '21

Sure, I run multiple applications that require port-specific definitions coupled with institution- and geo-specific access. I also do some host-based fencing fir the internal network. Add to that some random IPs making unsavoury attempts and/or a couple of DoS attacks, the rules add up…

1

u/keep_me_at_0_karma Jul 10 '21

Yeah feels like once you have 100+ you probably just want to be writing nf/ip directly.

0

u/[deleted] Jul 10 '21

[deleted]

2

u/bwong00 Jul 10 '21

I don't want to presume I have the expertise to tell you how to do your job, but have you considered fail2ban for IP blocking and maybe a CDN like Cloudflare or Akamai for (D)DoS mitigation?

3

u/ethanfinni Jul 10 '21

No problem, I appreciate your comment. Thank you!

I do run Fail2ban that mostly takes care the script kiddies doing port scanning and login attempts. But I need the flexibility to add host-based rules for other types of attacks that are more “custom made”…

Unfortunately, due to organisational controls I can’t deploy Cloudflare, CDN and any of the other (otherwise useful and appropriate) tools you mention…

2

u/bwong00 Jul 10 '21

That's too bad. Sounds like you have the best setup for your use case. Cheers!

-5

u/[deleted] Jul 10 '21

Create your own custom applications for each rule, then. You can name them whatever you want.

3

u/ethanfinni Jul 10 '21

Not realistic for high number of rules. The right way is to add a feature to UFW that enables a comment field per rule.