NAME
ufw-framework - using the ufw framework
DESCRIPTION
ufw provides both a command line interface and a framework for managing
a netfilter firewall. While the ufw command provides an easy to use
interface for managing a firewall, the ufw framework provides the
administrator methods to customize default behavior and add rules not
supported by the command line tool. In this way, ufw can take full
advantage of Linux netfilter's power and flexibility.
OVERVIEW
The framework provides boot time initialization, rules files for adding
custom rules, a method for loading netfilter modules, configuration of
kernel parameters and configuration of IPv6. The framework consists of
the following files:
/lib/ufw/ufw-init
initialization script
/etc/ufw/before[6].rules
rules file containing rules evaluated before UI added rules
/lib/ufw/user[6].rules
rules file containing UI added rules (managed with the ufw
command)
/etc/ufw/after[6].rules
rules file containing rules evaluated after UI added rules
/etc/defaults/ufw
high level configuration
/etc/ufw/sysctl.conf
kernel network tunables
/etc/ufw/ufw.conf
additional high level configuration
BOOT INITIALIZATION
ufw is started on boot with /lib/ufw/ufw-init. This script is a
standard SysV style initscript used by the ufw command and should not
be modified. It supports the following arguments:
start: loads the firewall
stop: unloads the firewall
restart:
reloads the firewall
force-reload:
same as restart
status:
basic status of the firewall
force-stop:
same as stop, except does not check if the firewall is already
loaded
flush-all:
flushes the built-in chains, deletes all non-built-in chains and
resets the policy to ACCEPT
ufw uses many user-defined chains in addition to the built-in iptables
chains. If MANAGE_BUILTINS in /etc/defaults/ufw is set to 'yes', on
stop and reload the built-in chains are flushed. If it is set to 'no',
on stop and reload the ufw secondary chains are removed and the ufw
primary chains are flushed. In addition to flushing the ufw specific
chains, it keeps the primary chains in the same order with respect to
any other user-defined chains that may have been added. This allows for
ufw to interoperate with other software that may manage their own
firewall rules.
To ensure your firewall is loading on boot, you must integrate this
script into the boot process. Consult your distribution's documentation
for the proper way to modify your boot process if ufw is not already
integrated.
RULES FILES
ufw is in part a front-end for iptables-restore, with its rules saved
in /etc/ufw/before.rules, /etc/ufw/after.rules and /lib/ufw/user.rules.
Administrators can customize before.rules and after.rules as desired
using the standard iptables-restore syntax. Rules are evaluated as
follows: before.rules first, user.rules next, and after.rules last.
IPv6 rules are evaluated in the same way, with the rules files named
before6.rules, user6.rules and after6.rules. Please note that ufw
status only shows rules added with ufw and not the rules found in the
/etc/ufw rules files.
Important: ufw only uses the *filter table by default. You may add any
other tables such as *nat, *raw and *mangle as desired. For each table
a corresponding COMMIT statement is required.
After modifying any of these files, you must reload ufw for the rules
to take effect. See the EXAMPLES section for common uses of these
rules files.
MODULES
Netfilter has many different connection tracking modules. These modules
are aware of the underlying protocol and allow the administrator to
simplify his or her rule sets. You can adjust which netfilter modules
to load by adjusting IPT_MODULES in /etc/defaults/ufw. Some popular
modules to load are:
nf_conntrack_ftp
nf_nat_ftp
nf_conntrack_irc
nf_nat_irc
nf_conntrack_netbios_ns
nf_conntrack_pptp
KERNEL PARAMETERS
ufw will read in /etc/ufw/sysctl.conf on boot when enabled. Please
note that /etc/ufw/sysctl.conf overrides values in the system
systcl.conf (usually /etc/sysctl.conf). Administrators can change the
file used by modifying /etc/default/ufw.
IPV6
IPv6 is disabled by default and all incoming, outging and forwarded
packets are dropped, with the exception of traffic on the loopback
interface. To change this behavior, set IPV6 to 'yes' in
/etc/defaults/ufw. See the ufw manual page for details.
EXAMPLES
As mentioned, ufw loads its rules files into the kernel by using the
iptables-restore and ip6tables-restore commands. Users wanting to add
rules to the ufw rules files manually must be familiar with these as
well as the iptables and ip6tables commands. Below are some common
examples of using the ufw rules files. All examples assume IPv4 only
and that DEFAULT_FORWARD_POLICY in /etc/defaults/ufw is set to DROP.
IP Masquerading
To allow IP masquerading for computers from the 10.0.0.0/8 network to
share the single IP address on eth0:
Edit /etc/ufw/sysctl.conf to have:
net.ipv4.ip_forward=1
Add to the end of /etc/ufw/before.rules, after the *filter section:
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
COMMIT
If your firewall is using IPv6 tunnels or 6to4 and is also doing NAT,
then you should not usually masquerade protocol '41' (ipv6) packets.
For example, instead of the above, /etc/ufw/before.rules can be
adjusted to have:
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/8 --protocol ! 41 -o eth0 -j
MASQUERADE
COMMIT
Port Redirections
To forward tcp port 80 on eth0 to go to the webserver at 10.0.0.2:
Edit /etc/ufw/sysctl.conf to have:
net.ipv4.ip_forward=1
Add to the *filter section of /etc/ufw/before.rules:
-A ufw-before-forward -m state --state RELATED,ESTABLISHED \
-j ACCEPT
-A ufw-before-forward -m state --state NEW -i eth0 \
-d 10.0.0.2 -p tcp --dport 80 -j ACCEPT
Add to the end of /etc/ufw/before.rules, after the *filter section:
*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT \
--to-destination 10.0.0.2:80
COMMIT
Egress filtering
To block RFC1918 addresses going out of eth0:
Add in the *filter section of /etc/ufw/before.rules:
-A ufw-before-forward -o eth0 -d 10.0.0.0/8 -j REJECT
-A ufw-before-forward -o eth0 -d 172.16.0.0/12 -j REJECT
-A ufw-before-forward -o eth0 -d 192.168.0.0/16 -j REJECT
Full example
This example combines the other examples and demonstrates a simple
routing firewall. Warning: this setup is only an example to demonstrate
the functionality of the ufw framework in a concise and simple manner
and should not be used in production without understanding what each
part does and does not do. Your firewall will undoubtedly want to be
less open.
This router/firewall has two interfaces: eth0 (Internet facing) and
eth1 (internal LAN). Internal clients have addresses on the 10.0.0.0/8
network and should be able to connect to anywhere on the Internet.
Connections to port 80 from the Internet should be forward to 10.0.0.2.
Access to ssh port 22 from the administrative workstation (10.0.0.100)
to this machine should be allowed. Also make sure no internal traffic
goes to the Internet.
Edit /etc/ufw/sysctl.conf to have:
net.ipv4.ip_forward=1
Add to the *filter section of /etc/ufw/before.rules:
-A ufw-before-forward -m state --state RELATED,ESTABLISHED \
-j ACCEPT
-A ufw-before-forward -i eth1 -s 10.0.0.0/8 -o eth0 -m state \
--state NEW -j ACCEPT
-A ufw-before-forward -m state --state NEW -i eth0 \
-d 10.0.0.2 -p tcp --dport 80 -j ACCEPT
-A ufw-before-forward -o eth0 -d 10.0.0.0/8 -j REJECT
-A ufw-before-forward -o eth0 -d 172.16.0.0/12 -j REJECT
-A ufw-before-forward -o eth0 -d 192.168.0.0/16 -j REJECT
Add to the end of /etc/ufw/before.rules, after the *filter section:
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT \
--to-destination 10.0.0.2:80
-A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
COMMIT
For allowing ssh on eth1 from 10.0.0.100, use the ufw command:
# ufw allow in on eth1 from 10.0.0.100 to any port 22 proto tcp
SEE ALSO
ufw, iptables(8), ip6tables(8), iptables-restore(8),
ip6tables-restore(8), sysctl(8), sysctl.conf(5)
AUTHOR
ufw is Copyright 2008-2009, Canonical Ltd.
ufw and this manual page was originally written by Jamie Strandboge
<jamie@canonical.com>