last day (15 days later) » 

Thomas W.
Thomas W.
12:27
0
Q: How to configure UFW for a basic desktop use?

BorisI'd like to record the way to configure the firewall UFW for basic purpose of a desktop.

firewall ufw
Your allow ruleset isn't exactly right, and in fact opens the system to extra risks. Your first step already allow outgoing. You already deny incoming in the first step too. As I understand ufw defaults, you don't need to open ports 80, 443, etc. as they are accepted by the 'related' rules that ufw transparently installs. You only open those ports if those services are running on the system, to permit incoming connections to those services, not to accept return traffic from the web browser use or an email client's use (since those are started on 'high number random ports'). — Thomas W. 11 mins ago
@ThomasW. I removed all my allow out rules and replaced by the default one: ufw default allow outgoing. Is that correct now, or does my remaining allow rules for incoming are wrong ? — Boris 2 mins ago
@Boris Lets continue this in Chat so I don't flood the comments here. — Thomas W. 1 min ago
Boris
Boris
sudo ufw allow http is nt allowing incoming http ?
Boris
Boris
12:46
If I can suggest, I would create one answer with UFW way, and create a 2nd answer, as alternative (perhpas better) with IPTABLES.
Thomas W.
Thomas W.
@Boris that would permit connections TO port 80 on the desktop from other systems. I think you fail to understand the application level port usage and mapping so let me explain
and I will be slow typing since I am on my phone
An application, say a web browser, will first select a random high number port for its side of the connection.
It will then connect outbound to a web server on some port, http is 80/tcp
That web server will be accepting port 80. your client communicates outbound on, say, port 53728.
So what my iptables rule does is acknowledge I have the outbound communication to some server's port 80, from my port 53727, and accepts related traffic
ufw as I understand it does much the same thing.
just transparently, from the end user's perspective
by telling ufw to accept port 80 inbound, you effectively expose port 80 on the desktop to connections from outside that computer
the exact opposite of what you want to do
and why do you want two different answers if you can accept only one?
(it is NOT bad form to propose multiple solutions to the same problem in an answer)
Anyways, because ufw by default should already have an equivalent rule to permit the related-to-something-this-system-initiated-outbound traffic, you have no need to open additional inbound ports
(in my example above: desktop 53728 <---> server 80, and that's the only real port connection/consideration for that tcp stream, from the firewall's perspective)
If you are running a desktop you aren't going to be accepting connections on port 80, which is where a webserver listens)

last day (15 days later) »