I have diskless Ubuntu 10.04 servers sitting naked on the Internet. They’re for internal use only, but I don’t have a firewall in that facility, so any firewalling must be done on the host itself. Ubuntu includes UFW, the “uncomplicated firewall,” a front end to iptables. I don’t know how anything can claim to make iptables uncomplicated, but I suppose nobody would use the tool if they called it “less appalling firewall.”
These servers need to be able to contact the Internet, to get updates and such, but nobody except myself and my coworkers need to access these servers. The coworkers and I only come from a limited range of IP addresses.
On a disk-based server, I would define rules in UFW and then run ufw default deny incoming, much like this:
# ufw enable # ufw allow from 10.0.1.0/24 # ufw allow from 172.16.5.0/24 # ufw default deny
If you do this on a diskless Ubuntu server, the system loses disk — even if you have a rule that specifically permits access to the diskless server. The obvious thing to try is to rip out the “default deny” and replace it with a rule to block unwanted traffic at the end.
# ufw deny from 0.0.0.0/0
Your resulting rules look like this:
# ufw status Status: active To Action From -- ------ ---- Anywhere ALLOW 10.0.1.0/24 Anywhere ALLOW 172.16.5.0/24 Anywhere DENY Anywhere
This looks like it should work. I attempt to connect to the SSH server from an IP not in the permitted list, however, and can connect. It’s not blocking traffic from denied hosts. Huh?
Go to the file that contains the user rules, /lib/ufw/user.rules. This is actually a script to feed to iptables. There are several lines like this, one for each block of management addresses:
### tuple ### allow any any 0.0.0.0/0 any 10.0.1.0 in -A ufw-user-input -s 10.0.1.0 -j ACCEPT
My last rule, however, looks different.
### tuple ### deny any any 0.0.0.0/0 any 0.0.0.0/0 in -A ufw-user-input -j DROP
The “all other IP addresses” is probably implied in that last rule, but… it really couldn’t be that simple, could it? I edit the script to explicitly specify the source IP addresses:
-A ufw-user-input-s 0.0.0.0/0 -j DROP
and reboot.
And yes, it is that simple. The firewall comes up at boot. ufw status displays exactly the same rules as before. But now, I can only connect from my management IP addresses.
The problem with tools that make things “uncomplicated” is that rather than removing the underlying complexity, they hide it. I probably need to break down and learn iptables, but I think I’d rather figure out how to get these hosts behind a PF box.