UFW Setup

11/08/2024

Introduction

In today's connected world, securing your server from potential threats is more important than ever. One of the most effective tools in your security toolkit is a firewall, and on Linux systems, UFW (Uncomplicated Firewall) stands out as a simple yet powerful option. UFW provides an intuitive interface to iptables, making it easier to manage your server’s security by controlling incoming and outgoing traffic. Having a firewall like UFW is essential because it acts as the first line of defense against unauthorized access and malicious attacks. By allowing only the necessary traffic and blocking everything else, UFW helps to minimize the risk of exploits, protect sensitive data, and ensure your server runs smoothly and securely. In this post, we’ll explore how UFW works and why it's a must-have for anyone serious about server security.

Installation

DISCLAIMER

If you are using SSH as your only means of accessing your device and cannot access it locally, pay extra attention to Step 3. Enabling your firewall without allowing your SSH port (default 22) will lock you out, preventing you from SSHing back into your device. Proceed with caution.

Make sure to update & upgrade your package repository
```
sudo apt update && sudo apt upgrade
```
Install UFW
```
sudo apt install ufw
```
Allow your SSH port
```
sudo ufw allow from 192.168.1.0/24 to any port 22
```
Double-check which subnet your network is on and fix the command accordingly.
Enable UFW
```
sudo ufw enable
```
Check the firewall status
```
sudo ufw status
```
If everything worked correctly, you should see:
```
pi@raspberrypi:~ $ sudo ufw status
Status: active
```

Allowing Ports for Internal Network only

When configuring UFW, it’s important to ensure that certain services like Pi-hole, Portainer, or other applications running on your server are accessible only within your internal network. This adds an extra layer of security by preventing external access.

For instance, if you want Pi-Hole's ports to be available only on your local network (192.168.1.0/24), you can restrict access to the necessary ports like this:

sudo ufw allow from 192.168.1.0/24 to any port 80
sudo ufw allow from 192.168.1.0/24 to any port 53

This setup ensures that only devices on your local network can access these services, keeping them shielded from the broader internet and enhancing your server’s security.

After configuring your rules, it’s crucial to reload the firewall to apply these changes:

sudo ufw reload

This ensures that your new rules are active and protecting your server immediately. Remember to always review your UFW rules periodically to ensure they align with your current security needs.

Allowing Ports for WireGuard traffic only

In addition to allowing specific ports, it’s often necessary to allow traffic from internal IP ranges, especially when using a VPN like WireGuard. If your WireGuard setup assigns IP addresses from a different internal range (e.g., 172.20.1.0/24), you’ll need to allow this range to access the necessary services. For example, to allow WireGuard clients to access a web service on your server, you would run:

sudo ufw allow from 172.20.1.0/24 to any port 80

This command ensures that any device connected via WireGuard can access your web service on port 80. Adjust the port and IP range as needed to ensure your VPN clients have the right level of access without compromising security.

Disable PING

To strengthen your system's security by disabling ICMP echo requests (PINGs) to your IP address, you'll need to modify the UFW configuration file. Blocking these echo requests helps prevent certain types of network reconnaissance, making it harder for potential attackers to discover your system through PINGs.

Open the configuration file
```
sudo nano /etc/ufw/before.rules
```
Locate the line that says "# ok icmp codes for INPUT", and directly below it, add:
```
-A ufw-before-input -p icmp --icmp-type echo-request -j DROP
```
After saving the changes, reload UFW with:
```
sudo ufw reload
```
In some cases, a system reboot might be necessary to apply the changes fully.

Summary

By configuring UFW to allow only specific ports for local IP ranges and WireGuard VPN, you've added a crucial layer of security to your network. This setup ensures that only trusted, internal connections can access your system, while external traffic remains blocked. By taking these steps, you're effectively minimizing potential attack vectors and enhancing the overall security of your environment. Remember to regularly review and update your firewall rules to adapt to any changes in your network.

After installing and enabling the firewall, I would suggest allowing only your Local IP range and the WireGuard IP range to any of the ports you are exposing. For example:

Of course, this only applies for services that are not meant to be exposed to the internet. If you host a publicly available website, I would suggest using a CloudFlare proxy and allowing only CloudFlare's IPs to your port 80 and/or 443.

Useful Commands

Enable/Disable the firewall
```
sudo ufw enable/disable
```
Reload the firewall
```
sudo ufw reload
```
Show the current allowed/blocked ports
```
sudo ufw status
```
Show the current allowed/blocked ports, numbered
```
sudo ufw status numbered
```
Allow a certain port from anywhere
```
sudo ufw allow [PORT]
```
Allow a certian port only from a specific IP range
```
sudo ufw allow from [IP Range] to any port [PORT]
```
Delete an ruke from the firewall
```
sudo ufw delete [RULE_NUMBER]
```

Conclusion

Securing your server with UFW is a simple yet crucial step in protecting your network and services. By carefully configuring and monitoring your firewall, you can ensure that only the necessary traffic reaches your system, keeping your data safe and your server running smoothly. Don’t leave your server vulnerable—take control with UFW today.