µÑÇÍÂèÒ§¡ÒÃãªé§Ò¹ ufw º¹ Ubuntu ¢Ñé¹¾×é¹°Ò¹

¨Ñ´·ÓàÁ×èÍ 06-09-2009
â´Â Í´ÔÈà ¢ÒÇÊѧ¢ì

º·¹Ó

ufw (Uncomplicated Firewall) à»ç¹à¤Ã×èͧÁÕÊÓËÃѺ¡Òä͹¿Ô¡ default firewall º¹ Ubuntu «Ö觶١¾Ñ²¹Ò¢Öé¹ÁÒà¾×èÍãËéÊÒÁÒö¤Í¹¿Ô¡ãªé§Ò¹ iptables firewall ä´é§èÒ¢Öé¹ â´Â ufw à»ç¹ user friendly 㹡ÒÃÊÃéÒ§ host-based firewall ·Ñé§áºº IPv4 áÅÐ IPv6

â´Â default áÅéÇ ufw ¨Ð¶Ù¡ disable äÇé  ·Ñ駹Õé ufw äÁèÁÕà»éÒËÁÒÂãËéà»ç¹ complete firewall functionality ¼èÒ¹ command line interface áµè¾Ñ²¹Ò¢Ñé¹à¾×èÍãËéÊÒÁÒöà¾ÔèÁËÃ×Íź¡®¢Í§ Firewall ·Õè§èÒ¢Öé¹  â´Â㹻Ѩ¨ØºÑ¹ÊÒÁÒöãªé§Ò¹à»ç¹ host-based firewall à»ç¹ËÅÑ¡

µÑÇÍÂèÒ§¡ÒÃãªé§Ò¹

  1. ¢Ñé¹ááµéͧ·Ó¡Òà enable µÑÇ ufw ´éǤÓÊÑè§
    sudo ufw enable
  2. àÃÒÊÒÁÒöà»Ô´¾ÍÃìµ ssh ´éǤÓÊÑè§
    sudo ufw allow 22
    «Öè§ÁÕ¤èÒà·èҡѺ :
    sudo ufw allow proto tcp from any to any port 22
  3. ÊÒÁÒöá·Ã¡µÓá˹觢ͧ¡®´éÇ¡ÒÃãªéµÑÇàÅ¢ÃкØà»ç¹µÓá˹è§ä´éàªè¹
    sudo ufw insert 1 allow 80
  4. ÊÒÁÒö»Ô´¾ÍÃìµ·Õèä´éà»Ô´àÍÒäÇé´éǤÓÊÑè§
    sudo ufw deny 22
  5. ÊÒÁÒöź¡®·Õèä´éÊÃéÒ§äÇé´éǤÓÊÑè§
    sudo ufw delete deny 22 ËÃ×Í
    sudo ufw delete allow 22
  6. ÊÒÁÒöÃÐºØ IP Address µé¹·Ò§áÅлÅÒ·ҧ¢Í§¡®ä´é´éǤÓÊÑè§:
    sudo ufw allow proto tcp from 192.168.0.2 to any port 22
  7. ÊÒÁÒö¡Ó˹´ IP Address à»ç¹ subnet ä´éàèèèªè¹
    sudo ufw allow proto tcp from 192.168.1.0/24 to any port 22
  8. àÃÒÊÒÁÒö disable ufw ´éǤÓÊÑè§
    sudo ufw disable
  9. ÊÒÁÒö´ÙʶҹТͧ ufw ´éǤÓÊÑè§
    sudo ufw status (¨ÐáÊ´§à©¾ÒÐ user rule à·èÒ¹Ñé¹)
  10. ÊÒÁÒö´ÙʶҹзÕèÕÁÕÃÒÂÅÐàÍÕ´à¾ÔèÁàµÔÁ´éǤÓÊÑè§
    sudo ufw status verbose (¨ÐáÊ´§à©¾ÒÐ user rule à·èÒ¹Ñé¹)

ÊÔ觷Õè¤ÇÃÃÙéà¾ÔèÁàµÔÁ

  1. àÁ×èÍàÃÒãééªéÖ¤ÓÊÑè§ ufw enable áÅéÇâ»Ãá¡ÃÁ¨ÐÊÃéÒ§¡®¾×é¹°Ò¹·Õè¨Óà»ç¹ãËé¡Ñºà¤Ã×èͧâ´ÂÍѵâ¹ÁѵÔâ´ÂÊÒÁÒö´Ùä´é¨Ò¡¤ÓÊÑè§ iptables -L «Ö觨Ðä´é¤èÒ¡®µèÒ§ æ ´Ñ§¹Õé

    root@www:~# iptables -L
    Chain INPUT (policy DROP)
    target     prot opt source               destination
    ufw-before-logging-input  all  --  anywhere             anywhere
    ufw-before-input  all  --  anywhere             anywhere
    ufw-after-input  all  --  anywhere             anywhere
    ufw-after-logging-input  all  --  anywhere             anywhere
    ufw-reject-input  all  --  anywhere             anywhere

    Chain FORWARD (policy DROP)
    target     prot opt source               destination
    ufw-before-logging-forward  all  --  anywhere             anywhere
    ufw-before-forward  all  --  anywhere             anywhere
    ufw-after-forward  all  --  anywhere             anywhere
    ufw-after-logging-forward  all  --  anywhere             anywhere
    ufw-reject-forward  all  --  anywhere             anywhere

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    ufw-before-logging-output  all  --  anywhere             anywhere
    ufw-before-output  all  --  anywhere             anywhere
    ufw-after-output  all  --  anywhere             anywhere
    ufw-after-logging-output  all  --  anywhere             anywhere
    ufw-reject-output  all  --  anywhere             anywhere

    Chain ufw-after-forward (1 references)
    target     prot opt source               destination

    Chain ufw-after-input (1 references)
    target     prot opt source               destination
    RETURN     udp  --  anywhere             anywhere            udp dpt:netbios-ns
    RETURN     udp  --  anywhere             anywhere            udp dpt:netbios-dgm
    RETURN     tcp  --  anywhere             anywhere            tcp dpt:netbios-ssn
    RETURN     tcp  --  anywhere             anywhere            tcp dpt:microsoft-ds
    RETURN     udp  --  anywhere             anywhere            udp dpt:bootps
    RETURN     udp  --  anywhere             anywhere            udp dpt:bootpc
    RETURN     all  --  anywhere             anywhere            ADDRTYPE match dst-type BROADCAST
    Chain ufw-after-logging-forward (1 references)
    target     prot opt source               destination

    Chain ufw-after-logging-input (1 references)
    target     prot opt source               destination

    Chain ufw-after-logging-output (1 references)
    target     prot opt source               destination

    Chain ufw-after-output (1 references)
    target     prot opt source               destination

    Chain ufw-before-forward (1 references)
    target     prot opt source               destination
    ufw-user-forward  all  --  anywhere             anywhere

    Chain ufw-before-input (1 references)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
    ufw-logging-deny  all  --  anywhere             anywhere            state INVALID
    DROP       all  --  anywhere             anywhere            state INVALID
    ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
    ACCEPT     icmp --  anywhere             anywhere            icmp source-quench
    ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
    ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem
    ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
    ACCEPT     udp  --  anywhere             anywhere            udp spt:bootps dpt:bootpc
    ufw-not-local  all  --  anywhere             anywhere
    ACCEPT     all  --  BASE-ADDRESS.MCAST.NET/4  anywhere
    ACCEPT     all  --  anywhere             BASE-ADDRESS.MCAST.NET/4
    ufw-user-input  all  --  anywhere             anywhere

    Chain ufw-before-logging-forward (1 references)
    target     prot opt source               destination

    Chain ufw-before-logging-input (1 references)
    target     prot opt source               destination

    Chain ufw-before-logging-output (1 references)
    target     prot opt source               destination

    Chain ufw-before-output (1 references)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     tcp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED
    ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED
    ufw-user-output  all  --  anywhere             anywhere

    Chain ufw-logging-allow (0 references)
    target     prot opt source               destination

    Chain ufw-logging-deny (2 references)
    target     prot opt source               destination

    Chain ufw-not-local (1 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere            ADDRTYPE match dst-type LOCAL
    RETURN     all  --  anywhere             anywhere            ADDRTYPE match dst-type MULTICAST
    RETURN     all  --  anywhere             anywhere            ADDRTYPE match dst-type BROADCAST
    ufw-logging-deny  all  --  anywhere             anywhere            limit: avg 3/min burst 10
    DROP       all  --  anywhere             anywhere

    Chain ufw-reject-forward (1 references)
    target     prot opt source               destination

    Chain ufw-reject-input (1 references)
    target     prot opt source               destination

    Chain ufw-reject-output (1 references)
    target     prot opt source               destination

    Chain ufw-user-forward (1 references)
    target     prot opt source               destination

    Chain ufw-user-limit (0 references)
    target     prot opt source               destination
    LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning prefix `[UFW LIMIT BLOCK] '
    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

    Chain ufw-user-limit-accept (0 references)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere

    Chain ufw-user-logging-forward (0 references)
    target     prot opt source               destination

    Chain ufw-user-logging-input (0 references)
    target     prot opt source               destination

    Chain ufw-user-logging-output (0 references)
    target     prot opt source               destination

    Chain ufw-user-output (1 references)
    target     prot opt source               destination
    root@www:~#

  2. â´Â¼Áà¢éÒã¨ÇèÒáËÅè§ÃÇÁ firewall script µèÒ§ æ ÍÂÙè·Õè /etc/ufw
  3. ÊÓËÃѺ¡®·ÕèÊÃéÒ§à¢éÒä»àͧ (user rule) ¨ÐÍÂÙè·Õèä¿Åì /var/lib/ufw/user.rules

¨º¤ÃѺ