Although optional, it is often recommended to run the update before installing a package.
$ apt-get update
It is quite straightforward to install a firewall.
$ apt-get intsall ufw
Setting firewall will take some effort on the contrary. Below are a few examples. To allow a subnet of IP addresses to access all ports inwards to this unit:
$ ufw allow from 192.168.1.0/24
To allow to access all ports outwards to an IP.
$ ufw allow out to 192.168.1.175
$ ufw allow out from 192.168.1.0/24 to any
To allow a specific port inwards or outwards:
$ ufw allow https
$ ufw allow 80
To allow for a specific IP to access ports
$ ufw allow from 192.168.1.175 to any port 21:22 proto tcp
After setting up, please check the configuration before enabling the firewall.
$ ufw status
$ ufw status numbered
To Action From
-- ------ ----
[ 1] 192.168.1.0/24 ALLOW OUT Anywhere (out)
[ 2] 25 ALLOW OUT Anywhere (out)
[ 3] 80 ALLOW IN Anywhere
[ 4] 443 ALLOW IN Anywhere
[ 5] Anywhere ALLOW IN 192.168.1.77
[ 6] Anywhere ALLOW IN 192.168.1.175
[ 7] 25 (v6) ALLOW OUT Anywhere (v6) (out)
[ 8] 80 (v6) ALLOW IN Anywhere (v6)
[ 9] 443 (v6) ALLOW IN Anywhere (v6)
Add any rules until all requirements met. Delete any unwanted rules if necessary, for example, rule
$ ufw delete 5
allow from 192.168.1.77
Proceed with operation (y|n)?
to confirm the deletion. The rules can also be manually edited, though not recommended, in the configuration file:
$ nano /etc/ufw/user.rules
To verify whether the rule meets the requirement via the
$ nc -vz 192.168.1.77 port_number
In particular, absolutely make sure SSH or telnet port(s) be accessible from the IP where you log in. If otherwise, the firewall might disrupt active/live connection to the unit. Enable first if disabled before active the firewall. Reload if previously enabled.
$ ufw enable
$ ufw reload
It might be a good practice to set default rule to
for all other connections.
$ ufw default deny