Security — Firewall
The Linux kernel includes the Netfilter subsystem, which is used to manipulate or decide the fate of network traffic headed into or through your server. All modern Linux firewall solutions use this system for packet filtering.
The kernel’s packet filtering system would be of little use to administrators without a userspace interface to manage it. This is the purpose of iptables: When a packet reaches your server, it will be handed off to the Netfilter subsystem for acceptance, manipulation, or rejection based on the rules supplied to it from userspace via iptables. Thus, iptables is all you need to manage your firewall, if you’re familiar with it, but many frontends are available to simplify the task.
ufw — Uncomplicated Firewall
The default firewall configuration tool for Ubuntu is ufw. Developed to ease iptables firewall configuration, ufw provides a user-friendly way to create an IPv4 or IPv6 host-based firewall.
ufw by default is initially disabled. From the ufw man page:
“ufw is not intended to provide complete firewall functionality via its command interface, but instead provides an easy way to add or remove simple rules. It is currently mainly used for host-based firewalls.”
The following are some examples of how to use ufw:
- First, ufw needs to be enabled. From a terminal prompt enter:
sudo ufw insert 1 allow 80 sudo ufw allow proto tcp from 192.168.0.2 to any port 22 sudo ufw --dry-run allow http *filter :ufw-user-input - [0:0] :ufw-user-output - [0:0] :ufw-user-forward - [0:0] :ufw-user-limit - [0:0] :ufw-user-limit-accept - [0:0] ### RULES ### ### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0 -A ufw-user-input -p tcp --dport 80 -j ACCEPT ### END RULES ### -A ufw-user-input -j RETURN -A ufw-user-output -j RETURN -A ufw-user-forward -j RETURN -A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT]: " -A ufw-user-limit -j REJECT -A ufw-user-limit-accept -j ACCEPT COMMIT Rules updated Note
If the port you want to open or close is defined in /etc/services , you can use the port name instead of the number. In the above examples, replace 22 with ssh.
This is a quick introduction to using ufw. Please refer to the ufw man page for more information.
ufw Application Integration
Applications that open ports can include an ufw profile, which details the ports needed for the application to function properly. The profiles are kept in /etc/ufw/applications.d , and can be edited if the default ports have been changed.
- To view which applications have installed a profile, enter the following in a terminal:
ufw allow from 192.168.0.0/24 to any app Samba Replace Samba and 192.168.0.0/24 with the application profile you are using and the IP range for your network.
Note There is no need to specify the protocol for the application, because that information is detailed in the profile. Also, note that the app name replaces the port number.
Not all applications that require opening a network port come with ufw profiles, but if you have profiled an application and want the file to be included with the package, please file a bug against the package in Launchpad.
IP Masquerading
The purpose of IP Masquerading is to allow machines with private, non-routable IP addresses on your network to access the Internet through the machine doing the masquerading. Traffic from your private network destined for the Internet must be manipulated for replies to be routable back to the machine that made the request. To do this, the kernel must modify the source IP address of each packet so that replies will be routed back to it, rather than to the private IP address that made the request, which is impossible over the Internet. Linux uses Connection Tracking (conntrack) to keep track of which connections belong to which machines and reroute each return packet accordingly. Traffic leaving your private network is thus “masqueraded” as having originated from your Ubuntu gateway machine. This process is referred to in Microsoft documentation as Internet Connection Sharing.
ufw Masquerading
IP Masquerading can be achieved using custom ufw rules. This is possible because the current back-end for ufw is iptables-restore with the rules files located in /etc/ufw/*.rules . These files are a great place to add legacy iptables rules used without ufw, and rules that are more network gateway or bridge related.
The rules are split into two different files, rules that should be executed before ufw command line rules, and rules that are executed after ufw command line rules.
- First, packet forwarding needs to be enabled in ufw. Two configuration files will need to be adjusted, in /etc/default/ufw change the DEFAULT_FORWARD_POLICY to “ACCEPT”:
DEFAULT_FORWARD_POLICY="ACCEPT" net/ipv6/conf/default/forwarding=1 # nat Table rules *nat :POSTROUTING ACCEPT [0:0] # Forward traffic from eth1 through eth0. -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE # don't delete the 'COMMIT' line or these nat table rules won't be processed COMMIT The comments are not strictly necessary, but it is considered good practice to document your configuration. Also, when modifying any of the rules files in /etc/ufw , make sure these lines are the last line for each table modified:
# don't delete the 'COMMIT' line or these rules won't be processed COMMIT For each Table a corresponding COMMIT statement is required. In these examples only the nat and filter tables are shown, but you can also add rules for the raw and mangle tables.
Note In the above example replace eth0, eth1, and 192.168.0.0/24 with the appropriate interfaces and IP range for your network.
sudo ufw disable && sudo ufw enable IP Masquerading should now be enabled. You can also add any additional FORWARD rules to the /etc/ufw/before.rules . It is recommended that these additional rules be added to the ufw-before-forward chain.
iptables Masquerading
iptables can also be used to enable Masquerading.
- Similar to ufw, the first step is to enable IPv4 packet forwarding by editing /etc/sysctl.conf and uncomment the following line:
net.ipv6.conf.default.forwarding=1 sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE - -t nat – the rule is to go into the nat table
- -A POSTROUTING – the rule is to be appended (-A) to the POSTROUTING chain
- -s 192.168.0.0/16 – the rule applies to traffic originating from the specified address space
- -o ppp0 – the rule applies to traffic scheduled to be routed through the specified network device
- -j MASQUERADE – traffic matching this rule is to “jump” (-j) to the MASQUERADE target to be manipulated as described above
sudo iptables -A FORWARD -s 192.168.0.0/16 -o ppp0 -j ACCEPT sudo iptables -A FORWARD -d 192.168.0.0/16 -m state \ --state ESTABLISHED,RELATED -i ppp0 -j ACCEPT iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE Logs
Firewall logs are essential for recognizing attacks, troubleshooting your firewall rules, and noticing unusual activity on your network. You must include logging rules in your firewall for them to be generated, though, and logging rules must come before any applicable terminating rule (a rule with a target that decides the fate of the packet, such as ACCEPT, DROP, or REJECT).
If you are using ufw, you can turn on logging by entering the following in a terminal:
To turn logging off in ufw, simply replace on with off in the above command.
If using iptables instead of ufw, enter:
sudo iptables -A INPUT -m state --state NEW -p tcp --dport 80 \ -j LOG --log-prefix "NEW_HTTP_CONN: " A request on port 80 from the local machine, then, would generate a log in dmesg that looks like this (single line split into 3 to fit this document):
[4304885.870000] NEW_HTTP_CONN: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 DF PROTO=TCP SPT=53981 DPT=80 WINDOW=32767 RES=0x00 SYN URGP=0 The above log will also appear in /var/log/messages , /var/log/syslog , and /var/log/kern.log . This behavior can be modified by editing /etc/syslog.conf appropriately or by installing and configuring ulogd and using the ULOG target instead of LOG. The ulogd daemon is a userspace server that listens for logging instructions from the kernel specifically for firewalls, and can log to any file you like, or even to a PostgreSQL or MySQL database. Making sense of your firewall logs can be simplified by using a log analyzing tool such as logwatch, fwanalog, fwlogwatch, or lire.
Other Tools
There are many tools available to help you construct a complete firewall without intimate knowledge of iptables. A command-line tool with plain-text configuration files:
References
- The Ubuntu Firewall wiki page contains information on the development of ufw.
- Also, the ufw manual page contains some very useful information: man ufw .
- See the packet-filtering-HOWTO for more information on using iptables.
- The nat-HOWTO contains further details on masquerading.
- The IPTables HowTo in the Ubuntu wiki is a great resource.
How to open ports in Linux? [closed]
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
I am working on a simple Node.js app. This requires a particular port to be open. For example if I want the app to listen to port (say) 5122, I will have to first open the port 5122. For this I have applied the following rule in my iptables
iptables -I INPUT 3 --proto tcp --dport 5122 -j ACCEPT service iptables save Initially this worked for me. But suddenly after some it stopped working. I now, wanted to check whether the port 5122 is really open or not. I issued the command
sudo iptables -L shows it like this - ACCEPT tcp -- anywhere anywhere tcp dpt:5122 ACCEPT tcp -- anywhere anywhere tcp dpt:5122 I see this line 2 times. Still confused! No idea. I now opened the following url http://www.yougetsignal.com/tools/open-ports/ and entered my host IP and Port and it says, Port 5122 is closed on 50.56.246.162 (which is my host IP) My question is how do I permanently keep a particular port open for listening. Any help would be highly appreciated.
1 Answer 1
You need to start running your application (using that port number) for the port to appear as open. As soon as it starts running and successfully listening on Port 5122, a local nmap scan will list that port as being open.
You only need to modify firewall rules once your application works to your satisfaction and you want to allow access to it from external host(s).
The output of iptables -L shows that your iptables command has successfully modified the firewall rules to allowed external access to your application. In fact, it looks like you inserted the rule twice; this doesn’t do any harm as the second rule won’t be processed.
Explanation
By default, all TCP and UDP ports are closed (not in a listening state). Only when a server or similar program opens a network socket and starts “listening” to a port number will that port appear to be open.
E.g., running nmap -sT localhost locally on my server shows that most ports are closed and only lists the ones that are open:
Nmap scan report for localhost (127.0.0.1) Host is up (0.00019s latency). rDNS record for 127.0.0.1: localhost.localdomain Not shown: 995 closed ports PORT STATE SERVICE 25/tcp open smtp 80/tcp open http 3306/tcp open mysql A firewall such as Netfilter / iptables can be used to selectively block access to ports whether they’re already open or not. In this case, those ports are considered to be filtered – though confusingly, some people and websites refer to filtered ports as being “closed” and the act of removing the firewall filter as “opening” a port.
E.g. running nmap -sT server.name on the same server from an external host reports different results since now the packets from the remote host are being filtered by the firewall:
Interesting ports on server.name (78.47.203.133): Not shown: 1679 filtered ports PORT STATE SERVICE 80/tcp open http Note that locally, ports 25 and 3306 are open but from an external perspective they are shown as being filtered.