95 lines
4.1 KiB
Markdown
95 lines
4.1 KiB
Markdown
|
# Linux firewalls, focusing on UFW (Uncomplicated Firewall) and firewalld(systemd):
|
||
|
|
|
||
|
|
## 1. Introduction to Linux Firewalls
|
||
|
|
Linux firewalls are essential security tools that control incoming and outgoing network traffic based on predetermined security rules. They act as a barrier between trusted internal networks and untrusted external networks, such as the Internet.
|
||
|
|
|
||
|
|
## 2. Iptables: The Foundation
|
||
|
|
At the core of most Linux firewall solutions is iptables, a command-line utility for configuring the Linux kernel firewall. It works by defining chains of rules that filter packets based on various criteria.
|
||
|
|
|
||
|
|
Key concepts:
|
||
|
|
- Tables: filter, nat, mangle, raw
|
||
|
|
- Chains: INPUT, OUTPUT, FORWARD
|
||
|
|
- Rules: match criteria and target actions
|
||
|
|
|
||
|
|
While powerful, iptables can be complex for beginners, which led to the development of more user-friendly front-ends like UFW and firewalld.
|
||
|
|
|
||
|
|
## 3. UFW (Uncomplicated Firewall)
|
||
|
|
|
||
|
|
UFW is a simplified interface for managing iptables. It's designed to be easy to use while still providing robust firewall capabilities.
|
||
|
|
|
||
|
|
Key features:
|
||
|
|
- Simple command-line syntax
|
||
|
|
- Application profiles
|
||
|
|
- IPv6 support
|
||
|
|
|
||
|
|
Basic UFW commands:
|
||
|
|
```
|
||
|
|
sudo ufw enable # Enable the firewall
|
||
|
|
sudo ufw disable # Disable the firewall
|
||
|
|
sudo ufw status # Check firewall status
|
||
|
|
sudo ufw allow 22 # Allow incoming traffic on port 22 (SSH)
|
||
|
|
sudo ufw deny 80 # Deny incoming traffic on port 80 (HTTP)
|
||
|
|
sudo ufw allow from 192.168.1.0/24 # Allow traffic from a specific subnet
|
||
|
|
```
|
||
|
|
|
||
|
|
Advanced usage:
|
||
|
|
- Rate limiting: `sudo ufw limit 22/tcp`
|
||
|
|
- Logging: `sudo ufw logging on`
|
||
|
|
- Application profiles: `sudo ufw allow 'Apache Full'`
|
||
|
|
|
||
|
|
## 4. firewalld
|
||
|
|
|
||
|
|
firewalld is a dynamic firewall manager, primarily used in Red Hat-based distributions. It introduces the concept of zones, making it easier to manage complex network environments.
|
||
|
|
|
||
|
|
Key features:
|
||
|
|
- Zone-based configuration
|
||
|
|
- Runtime and permanent configuration options
|
||
|
|
- D-Bus interface for easy integration with other applications
|
||
|
|
|
||
|
|
Basic firewalld commands:
|
||
|
|
```
|
||
|
|
sudo systemctl start firewalld # Start firewalld
|
||
|
|
sudo systemctl enable firewalld # Enable firewalld to start on boot
|
||
|
|
sudo firewall-cmd --state # Check firewalld status
|
||
|
|
sudo firewall-cmd --zone=public --add-service=http # Allow HTTP traffic in the public zone
|
||
|
|
sudo firewall-cmd --zone=internal --add-source=192.168.1.0/24 # Add a source to the internal zone
|
||
|
|
```
|
||
|
|
|
||
|
|
Advanced usage:
|
||
|
|
- Custom services: `sudo firewall-cmd --new-service=myapp`
|
||
|
|
- Rich rules: `sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="80" protocol="tcp" accept'`
|
||
|
|
- Direct interface (for complex iptables rules): `sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 22 -j ACCEPT`
|
||
|
|
|
||
|
|
## 5. Comparing UFW and firewalld
|
||
|
|
|
||
|
|
### UFW:
|
||
|
|
- Simpler, more straightforward for basic setups
|
||
|
|
- Ideal for single-host systems or simple network configurations
|
||
|
|
- Easier to learn for beginners
|
||
|
|
|
||
|
|
### firewalld:
|
||
|
|
- More flexible and powerful for complex network setups
|
||
|
|
- Better suited for enterprise environments with multiple network zones
|
||
|
|
- Offers runtime and permanent configuration options
|
||
|
|
|
||
|
|
## 6. Best Practices
|
||
|
|
- Use the principle of least privilege: only open ports that are necessary
|
||
|
|
- Regularly review and update firewall rules
|
||
|
|
- Use logging to monitor firewall activity
|
||
|
|
- Combine firewall rules with other security measures (e.g., fail2ban for intrusion prevention)
|
||
|
|
- Keep your firewall software updated
|
||
|
|
|
||
|
|
## 7. Troubleshooting
|
||
|
|
- Check firewall logs: `/var/log/ufw.log` for UFW, `journalctl -u firewalld` for firewalld
|
||
|
|
- Use `iptables -L -v` to view current rules (works for both UFW and firewalld)
|
||
|
|
- Test connections with tools like `netcat` or `telnet`
|
||
|
|
- Temporarily disable the firewall to isolate issues
|
||
|
|
|
||
|
|
## 8. Advanced Topics
|
||
|
|
- Stateful vs. stateless firewalls
|
||
|
|
- Network Address Translation (NAT) configuration
|
||
|
|
- Setting up DMZ (Demilitarized Zone)
|
||
|
|
- Integrating with intrusion detection/prevention systems (IDS/IPS)
|
||
|
|
|
||
|
|
This guide provides a comprehensive overview of Linux firewalls, focusing on UFW and firewalld. Each tool has its strengths, and the choice between them often depends on the specific requirements of your system and network configuration.
|