Dernière version du 15 octobre 2023 à 20:12

Liens

Configuration

Once a rule is matched the others will not be evaluated so you must put the specific rules first.

# lister les règles
ufw status verbose

# lister les commandes qui ont permis d'ajouter des règles
ufw show added

# autoriser les connections tcp sur le port 53
ufw allow 53/tcp comment 'DNS tcp 53'

# autoriser une ip à accéder au port 22 en tcp quelle que soit la destination (any)
ufw allow from 192.168.0.1 to any port 22 proto tcp

# supprimer le règle qui autorise les connections tcp sur le port 53
ufw deny 53/tcp

# lister les régles avec leur numéro
ufw status numbered

# supprimer la règle numéro 2
ufw delete 2

# insérer une règle en position 1
ufw insert 1 allow 53/tcp

# interdire les connections udp sur le port 53
ufw deny 53/udp

# allow any protocol from inside 192.168.0.0/24 LAN
ufw allow from 192.168.0.0/24
# allow incoming rate limited SSH traffic from anywhere
ufw limit ssh

Applications

# lister les configurations pour les applications (/etc/ufw/applications.d/*)
ufw app list

# appliquer la configuration de l'application [appname]
ufw allow [appname] comment 'tcp xx'
# only for packages from 192.168.0.0/24
ufw allow from 192.168.0.0/24 to any app [appname]
# only for packages to 192.168.0.0/24
ufw allow to 192.168.0.0/24 app [appname]

# ne plus appliquer la configuration de l'application [appname]
ufw delete allow [appname]

# update ufw after having modified the [appname] config file
ufw app update [appname]

# display the info on the [appname] config file
ufw app info [appname]

Applications custom

/etc/ufw/applications.d/dnsmasq

[DNS]
title=DNS server
description=DNS server
ports=53

[DHCP]
title=DHCP server
description=DHCP server
ports=67,68/udp

/etc/ufw/applications.d/openvpn

[VPN]
title=VPN server
description=VPN server
ports=1194/udp

/etc/ufw/applications.d/transmission

[Torrent]
title=Torrent server
description=Torrent server
ports=9091/tcp|51413

/etc/ufw/applications.d/amule

[Amule]
title=Amule server
description=Amule server
ports=4662,4711,4712/tcp|4665,4672/udp

/etc/ufw/applications.d/minidlna

[DLNA]
title=MiniDLNA
description=DLNA media streaming server
ports=8200/tcp|1900/udp

/etc/ufw/applications.d/gogs

[GOGS]
title=Gogs
description=A painless self-hosted Git service
ports=3000/tcp

Démarrage / status

Ne pas oublier d'ouvrir le port SSH avant de démarrer UFW.

# démarre/stoppe ufw et l'ajoute/le retire des programmes à lancer au démarrage
ufw enable
ufw disable

# démarre ufw
ufw reload

# redémarrer le firewall
sudo service ufw restart
sudo ufw reload

# lister les régles
ufw status verbose

Règles

/etc/ufw/before.rules

-A ufw-before-input -p 2 -d 224.0.0.1 -j ACCEPT

/etc/ufw/before6.rules

# règle pour autoriser le multicast
-A ufw6-before-input -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT

ufw deny from 0.0.0.0

ipset

Add drop rules which match ipset sets

/etc/ufw/before.rules

# drop packets from [set-name]
-I INPUT -m set --match-set [set-name] src -j DROP

Sets have to be created before ufw starts: force netfilter-persistent.service to start before ufw.

/lib/systemd/system/netfilter-persistent.service

Before=network-pre.target shutdown.target ufw.service

Geo IP block

ai geoip-database geoip-bin geoipupdate xtables-addons-common

# test
geoiplookup 58.22.14.217            
GeoIP Country Edition: CN, China

modprobe xt_geoip
lsmod | grep ^xt_geoip

iptables -m geoip -h

/etc/ufw/before.rules

# drops all traffic from RU and CN 
-A ufw-before-input -m geoip --src-cc RU,CN -j DROP

Log

/var/log/ufw.log

Erreurs

# analyze blocked packages
sudo tcpdump -p host 224.0.0.1

UFW ne se lance pas au démarrage

Utiliser cron

En l'absence de solution, cron peut lancer UFW après un reboot.

crontab

@reboot root ufw enable

Modifier le service UFW

/lib/systemd/system/ufw.service

#Before=network.target
After=network-pre.target  # doesn't work
After=netfilter-persistent.service  # doesn't work

[UFW BLOCK] SRC=192.168.0.254 DST=224.0.0.1 PROTO=2

/etc/ufw/before.rules

# [UFW BLOCK] IN=eth0 OUT= MAC=XX:...:XX SRC=192.168.0.254 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x80 TTL=1 ID=0 DF PROTO=2
# livebox.home > all-systems.mcast.net: igmp query v2

# drop multicast IGMP packages sent by the livebox
-A ufw-before-input -i eth0 -s 192.168.0.254 -d 224.0.0.1 -p igmp -j DROP

# ??? allow MULTICAST mDNS for service discovery ???
-A ufw-before-input -i eth0 -p udp -d 224.0.0.1 -s 192.168.0.254 --dport 5353 -j ACCEPT

[UFW BLOCK] SRC=192.168.0.x DST=239.255.255.250

/etc/ufw/before.rules

# allow MULTICAST UPnP for service discovery
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT

# IN=eth0 OUT= MAC= SRC=192.168.0.x DST=239.255.255.250 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
-A ufw-before-input -i eth0 -p igmp -d 239.255.255.250 -s 192.168.0.x -j ACCEPT

# allow Web Services Dynamic Discovery (port 3702 on IP multicast 239.255.255.250)
# IN=eth0 OUT= MAC=XX:..:XX SRC=192.168.0.x DST=239.255.255.250 LEN=684 TOS=0x00 PREC=0x00 TTL=1 ID=22271 PROTO=UDP SPT=58421 DPT=3702 LEN=664
-A ufw-before-input -i eth0 -p udp -s 192.168.0.0/24 -d 239.255.255.250 --dport 3702 -j ACCEPT

[UFW BLOCK] RST

/etc/ufw/before.rules

# [UFW BLOCK] IN=eth0 OUT= PROTO=TCP RST
-A ufw-before-input -i eth0 -p tcp --tcp-flags ALL RST -j DROP

[UFW BLOCK] DPT=853

Port 853 is used by DNS over TLS service.

/etc/ufw/before.rules

# [UFW BLOCK] IN=eth0 SRC=192.168.a.b DST=192.168.x.y PROTO=TCP DPT=853
-A ufw-before-input -i eth0 -d 192.168.x.y -p tcp --dport 853 -j DROP

« Ufw » : différence entre les versions

Dernière version du 15 octobre 2023 à 20:12

Sommaire

Liens

Configuration

Applications

Applications custom

Démarrage / status

Règles

ipset

Geo IP block

Log

Erreurs

UFW ne se lance pas au démarrage

Utiliser cron

Modifier le service UFW

[UFW BLOCK] SRC=192.168.0.254 DST=224.0.0.1 PROTO=2

[UFW BLOCK] SRC=192.168.0.x DST=239.255.255.250

[UFW BLOCK] RST

[UFW BLOCK] DPT=853

Actions de la page

Actions de la page

Outils personnels

Menu de navigation

Navigation

Rechercher

Outils

@@ Ligne 49 : / Ligne 49 : @@
 ufw allow [appname] comment 'tcp xx'
 # only for packages from 192.168.0.0/24
-ufw allow from 192.168.0.0/24 [appname]
+ufw allow from 192.168.0.0/24 to any app [appname]
 # only for packages to 192.168.0.0/24
-ufw allow to 192.168.0.0/24 [appname]
+ufw allow to 192.168.0.0/24 app [appname]
 # ne plus appliquer la configuration de l'application [appname]
@@ Ligne 102 : / Ligne 102 : @@
 description=DLNA media streaming server
 ports=8200/tcp|1900/udp
+</filebox>
+<filebox fn='/etc/ufw/applications.d/gogs' lang=ini collapsed>
+[GOGS]
+title=Gogs
+description=A painless self-hosted Git service
+ports=3000/tcp
 </filebox>
@@ Ligne 137 : / Ligne 144 : @@
 </kode>
-= Log =
+= ipset =
-== Multicast ==
+Add drop rules which match ipset sets
-<filebox fn=/var/log/ufw.log lang=bash>
+<filebox fn='/etc/ufw/before.rules' lang='bash'>
-[UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:e8:b7:48:bb:29:94:08:00
+# drop packets from [set-name]
-                         SRC=0.0.0.0
+-I INPUT -m set --match-set [set-name] src -j DROP
-                         DST=224.0.0.1
+</filebox>
-    LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
+Sets have to be created before ufw starts: force netfilter-persistent.service to start before ufw.
+<filebox fn='/lib/systemd/system/netfilter-persistent.service' lang='ini'>
+Before=network-pre.target shutdown.target ufw.service
+</filebox>
+= [https://ultramookie.com/2020/10/geoip-blocking-ubuntu-20.04/ Geo IP block] =
+<kode lang='bash'>
+ai geoip-database geoip-bin geoipupdate xtables-addons-common
+# test
+geoiplookup 58.22.14.217
+GeoIP Country Edition: CN, China
-# depuis le serveur lui-même
+modprobe xt_geoip
-SRC=0.0.0.0
+lsmod | grep ^xt_geoip
-# NDP (neighbor discovery protocol) uses 224.0.0.1 to send a packet in multicast
-# 224.0.0.0/8 adresses multicast
-DST=224.0.0.1
-[UFW BLOCK] IN=eth0 OUT= MAC=33:33:00:00:00:01:00:30:18:54:28:2a:86:dd
+iptables -m geoip -h
-                         SRC=fe80:0000:0000:0000:0230:18ff:fe54:282a
+</kode>
-                         DST=ff02:0000:0000:0000:0000:0000:0000:0001
-    LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0
-# depuis le serveur lui-même (ipv6 du serveur)
+<filebox fn='/etc/ufw/before.rules' lang='bash'>
-SRC=fe80:0000:0000:0000:0230:18ff:fe54:282a
+# drops all traffic from RU and CN
-# NDP (neighbor discovery protocol) uses ff02::1 to send a packet in multicast
+-A ufw-before-input -m geoip --src-cc RU,CN -j DROP
-DST=ff02:0000:0000:0000:0000:0000:0000:0001
 </filebox>
-<kode lang=bash>
+= Log =
-# ufw ne log plus s'il trouve une règle qui correspond
+{{boxx|/var/log/ufw.log}}
-# il suffit donc d'autoriser ou d'interdire ces flux
-sudo ufw deny from 0.0.0.0 to 224.0.0.1
+= Erreurs =
-sudo ufw deny from fe80::0230:18ff:fe54:282a to ff02::1
+<kode lang='bash'>
+# analyze blocked packages
+sudo tcpdump -p host 224.0.0.1
 </kode>
-= Erreurs =
 == UFW ne se lance pas au démarrage ==
 === [https://bugs.launchpad.net/ubuntu/+source/ufw/+bug/1726856 Utiliser cron] ===
@@ Ligne 184 : / Ligne 198 : @@
 </filebox>
-== <nowiki>[UFW BLOCK]</nowiki> SRC=192.168.0.254 DST=224.0.0.1 ==
+== <nowiki>[UFW BLOCK]</nowiki> SRC=192.168.0.254 DST=224.0.0.1 PROTO=2 ==
-<kode lang='bash'>
+<filebox fn='/etc/ufw/before.rules' lang=bash>
 # [UFW BLOCK] IN=eth0 OUT= MAC=XX:...:XX SRC=192.168.0.254 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x80 TTL=1 ID=0 DF PROTO=2
+# livebox.home > all-systems.mcast.net: igmp query v2
+# drop multicast IGMP packages sent by the livebox
+-A ufw-before-input -i eth0 -s 192.168.0.254 -d 224.0.0.1 -p igmp -j DROP
+# ??? allow MULTICAST mDNS for service discovery ???
+-A ufw-before-input -i eth0 -p udp -d 224.0.0.1 -s 192.168.0.254 --dport 5353 -j ACCEPT
+</filebox>
+== <nowiki>[UFW BLOCK]</nowiki> SRC=192.168.0.x DST=239.255.255.250 ==
+<filebox fn='/etc/ufw/before.rules' lang=bash>
+# allow MULTICAST UPnP for service discovery
+-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
+# IN=eth0 OUT= MAC= SRC=192.168.0.x DST=239.255.255.250 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
+-A ufw-before-input -i eth0 -p igmp -d 239.255.255.250 -s 192.168.0.x -j ACCEPT
+# allow Web Services Dynamic Discovery (port 3702 on IP multicast 239.255.255.250)
+# IN=eth0 OUT= MAC=XX:..:XX SRC=192.168.0.x DST=239.255.255.250 LEN=684 TOS=0x00 PREC=0x00 TTL=1 ID=22271 PROTO=UDP SPT=58421 DPT=3702 LEN=664
+-A ufw-before-input -i eth0 -p udp -s 192.168.0.0/24 -d 239.255.255.250 --dport 3702 -j ACCEPT
+</filebox>
-# autoriser
+== <nowiki>[UFW BLOCK]</nowiki> RST ==
-sudo ufw allow in on eth0 from 192.168.0.254 to 224.0.0.1 comment 'Multicast'
+<filebox fn='/etc/ufw/before.rules' lang=bash>
-# interdire
+# [UFW BLOCK] IN=eth0 OUT= PROTO=TCP RST
-sudo ufw deny from 192.168.0.254 to 224.0.0.1
+-A ufw-before-input -i eth0 -p tcp --tcp-flags ALL RST -j DROP
-</kode>
+</filebox>
+== <nowiki>[UFW BLOCK]</nowiki> DPT=853 ==
+Port 853 is used by DNS over TLS service.
+<filebox fn='/etc/ufw/before.rules' lang=bash>
+# [UFW BLOCK] IN=eth0 SRC=192.168.a.b DST=192.168.x.y PROTO=TCP DPT=853
+-A ufw-before-input -i eth0 -d 192.168.x.y -p tcp --dport 853 -j DROP
+</filebox>

« Ufw » : différence entre les versions

Dernière version du 15 octobre 2023 à 20:12

Liens

Configuration

Applications

Applications custom

Démarrage / status

Règles

ipset

Geo IP block

Log

Erreurs

UFW ne se lance pas au démarrage

Utiliser cron

Modifier le service UFW

[UFW BLOCK] SRC=192.168.0.254 DST=224.0.0.1 PROTO=2

[UFW BLOCK] SRC=192.168.0.x DST=239.255.255.250

[UFW BLOCK] RST

[UFW BLOCK] DPT=853

Menu de navigation

Rechercher

« Ufw » : différence entre les versions