Ufw

Disable IPv6

/etc/default/ufw <source lang=bash>

1. Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
2. accepted). You will need to 'disable' and then 'enable' the firewall for
3. the changes to take affect.

IPV6=no </syntaxhighlight>

/etc/ufw/sysctl.conf <source lang=bash>

1. Uncomment this to turn off ipv6 autoconfiguration

net/ipv6/conf/default/autoconf=0 net/ipv6/conf/all/autoconf=0 </syntaxhighlight>

Setup Rules

Adding a rule

<source lang=bash>

1. ufw allow log-all from 192.168.2.0/24 to any app OpenSSH

Rule added

1. ufw status verbose

Status: active Logging: on (low) Default: reject (incoming), allow (outgoing), disabled (routed) New profiles: skip

To Action From -- ------ ---- 22/tcp (OpenSSH) ALLOW IN 192.168.2.0/24 (log-all) </syntaxhighlight>

Inserting before

<source lang=bash>

1. ufw insert 1 allow log-all from 192.168.1.0/24 to any app OpenSSH

Rule inserted

1. ufw status verbose

Status: active Logging: on (low) Default: reject (incoming), allow (outgoing), disabled (routed) New profiles: skip

To Action From -- ------ ---- 22/tcp (OpenSSH) ALLOW IN 192.168.1.0/24 (log-all) 22/tcp (OpenSSH) ALLOW IN 192.168.2.0/24 (log-all)

1. ufw status numbered

Status: active

    To                         Action      From
    --                         ------      ----

[ 1] OpenSSH ALLOW IN 192.168.1.0/24 (log-all) [ 2] OpenSSH ALLOW IN 192.168.2.0/24 (log-all) </syntaxhighlight>

Own applications

nrpe

/etc/ufw/applications.d/nrpe <source lang=bash> [NRPE] title=Nagios NRPE description=Nagios Remote Plugin Executor ports=5666/tcp </syntaxhighlight>

MySQL

/etc/ufw/applications.d/mysql <source lang=bash> [MySQL] title=MySQL Server (MySQL, MYSQL) description=Old and rusty SQL server ports=3306/tcp </syntaxhighlight>

Exim

/etc/ufw/applications.d/exim <source lang=bash> [Exim SMTP] title=Mail Server (Exim, SMTP) description=Small, but very powerful and efficient mail server ports=25/tcp

[Exim SMTP Virusscanned] title=Mail Server (Exim, SMTP Virusscanned) description=Small, but very powerful and efficient mail server ports=26/tcp

[Exim SMTPS] title=Mail Server (Exim, SMTPS) description=Small, but very powerful and efficient mail server ports=465/tcp

[Exim SMTP Message Submission] title=Mail Server (Exim, Message Submission) description=Small, but very powerful and efficient mail server ports=587/tcp </syntaxhighlight>

Get a list of rules to set from Exim's configuration: <source lang=awk>

1. exim -bP local_interfaces | awk '

BEGIN{

 ports[25]="Exim SMTP";
 ports[26]="Exim SMTP Virusscanned"
 ports[465]="Exim SMTPS";
 ports[587]="Exim SMTP Message Submission";
 from="any"; #                                <----- Look if it fits what you want

} {

 gsub(/^.*= /,"");
 split($0,services,/ : /);
 for(service in services){
   split(services[service],part,/\./);
   ip=part[1]"."part[2]"."part[3]"."part[4];
   port=part[5];
   printf "ufw allow log from %s to %s app \"%s\"\n",from,ip,ports[port];
 }

}' ufw allow log from any to 192.168.5.103 app "Exim SMTP" ufw allow log from any to 192.168.5.103 app "Exim SMTP Virusscanned" ufw allow log from any to 192.168.5.103 app "Exim SMTPS" </syntaxhighlight>

Inspect your application profile

<source lang=bash>

1. ufw app info MySQL

Profile: MySQL Title: MySQL Server (MySQL, MYSQL) Description: Old and rusty SQL server

Port:

 3306/tcp

</syntaxhighlight>