En:HOWTO: Introduction Firewalling with UFW

{{i18n| en}

Introduction

During the installation of Sabayon Linux, there is a possibility in the Anaconda installer that you activate a firewall. That is actually a good idea.

Sabayon Linux is using "Uncomplicated Firewall" (UFW) to generate the iptables rules. In the repositories you can find ufw-frontends and kcm-ufw (KDE specific) as graphical interfaces to configure UFW, but in this article we're going to use the command-line interface.

The manpage of UFW is very well documented, this article is just an introduction.

Enable / Disable UFW

UFW is by default added to the default boot. You can check this with:

# sudo rc-update | grep ufw

You can remove it with:

# sudo rc-update remove ufw default

But it's better to disable / enable UFW with:

# sudo ufw disable
# sudo ufw enable

Open / Close ports for applications

You can open and close ports for a specific set of applications. To show the list of applications available use:

# sudo ufw app list

Then you can open the port with:

# sudo ufw allow <application>

Take ssh for example

# sudo ufw allow ssh
# sudo ufw deny ssh

Open / Close specific ports

If an application is not in the application list, you have to find out which port it's using. The file /etc/services can be helpfull or

# sudo ss -tul

Let's open udp port 53

# sudo ufw allow 53/udp

You can be more specific, maybe you want only access from a specific range to your ssh server. If you use the parameter "allow ssh", this is what actually happening:

# sudo ufw allow proto tcp from any to any port 22

To be more restrictive:

# sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22

Delete rules

If you want to delete rules, then you have to know which rules are available:

# sudo ufw show added

Maybe you see somehing like "ufw deny 53/udp". Actually it's a summarization of:

# sudo ufw deny proto udp from any to any port 53

You can delete the rule with:

# sudo ufw delete deny proto udp from any to any port 53

Another way:

# sudo ufw status numbered
# sudo delete <number>