{"id":19360,"date":"2017-01-02T06:19:32","date_gmt":"2017-01-01T22:19:32","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/01\/02\/ubuntu-server-ufw-firewall\/"},"modified":"2017-01-02T06:19:32","modified_gmt":"2017-01-01T22:19:32","slug":"ubuntu-server-ufw-firewall","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/01\/02\/ubuntu-server-ufw-firewall\/","title":{"rendered":"Ubuntu Server ufw Firewall"},"content":{"rendered":"

\u5b89\u88dd ufw \u5957\u4ef6
# apt-get install ufw<\/span>
\u8a2d\u5b9a ufw (0.35-0ubuntu2) …<\/span>
Creating config file \/etc\/ufw\/before.rules with new version<\/span>
Creating config file \/etc\/ufw\/before6.rules with new version<\/span>
Creating config file \/etc\/ufw\/after.rules with new version<\/span>
Creating config file \/etc\/ufw\/after6.rules with new version<\/span>
Processing triggers for systemd (229-4ubuntu13) …<\/span>
Processing triggers for ureadahead (0.100.0-19) …<\/span> <\/p>\n

1. \u505c\u7528\u9632\u706b\u7246\uff0c\u53d6\u6d88\u958b\u6a5f\u6642\u57f7\u884c
# ufw disable<\/span>
Firewall stopped and disabled on system startup<\/span> <\/p>\n

\u672a\u555f\u7528
# ufw status<\/span>
Status: inactiv[@more@]<\/span>2. \u555f\u7528\u9632\u706b\u7246
# ufw enable<\/span>
Firewall is active and enabled on system startup<\/span> <\/p>\n

\u5df2\u555f\u7528
# ufw status<\/span>
Status: active<\/span> <\/p>\n

3. \u9810\u8a2d\u898f\u5247
\u9810\u8a2d\u540c\u610f
# ufw default allow<\/span>
\u62d2\u7d55\u5916\u90e8\u9023\u7dda
# ufw default deny incoming<\/span>
Default incoming policy changed to ‘deny’<\/span>
(be sure to update your rule accordingly)<\/span>
\u9810\u8a2d\u62d2\u7d55
# ufw default deny<\/span>
\u540c\u610f\u5c0d\u5916\u9023\u7dda
# ufw default allow outgoing<\/span>
Default outgoing policy changed to ‘allow’<\/span>
(be sure to update your rule accordingly)<\/span> <\/p>\n

4. \u9632\u706b\u7246\u898f\u5247
# ufw allow in 22\/tcp<\/span>
# ufw allow in ssh<\/span>
# ufw allow in http
<\/span># ufw allow out http<\/span>
# ufw allow from 192.168.1.0\/24<\/span>
# ufw allow from 192.168.1.0\/24 port 22<\/span>
# ufw allow proto tcp from 192.168.1.0\/24 port 22<\/span>
# ufw deny from 192.168.1.17 to 192.168.1.16 port 22<\/span>
# ufw allow from 192.168.1.0\/24 to 192.168.1.16 port 22<\/span> <\/p>\n

5. \u5217\u51fa\u9632\u706b\u7246\u898f\u5247
# ufw status<\/span>
Status: active<\/span> <\/p>\n

To\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Action\u00a0\u00a0\u00a0\u00a0\u00a0 From<\/span>
—\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ——\u00a0\u00a0\u00a0\u00a0\u00a0 —-<\/span>
22\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere<\/span>
443\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere<\/span>
53\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere<\/span>
22\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere<\/span>
1194\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere<\/span>
22\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 192.168.1.0\/24<\/span>
22 (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
443\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
53 (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
22\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
1194\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Anywhere (v6)<\/span> <\/p>\n

\u52a0\u4e0a\u7de8\u865f
# ufw status numbered<\/span>
Status: active<\/span> <\/p>\n

\u00a0\u00a0\u00a0\u00a0 To\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Action\u00a0\u00a0\u00a0\u00a0\u00a0 From<\/span>
\u00a0\u00a0\u00a0\u00a0 —\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ——\u00a0\u00a0\u00a0\u00a0\u00a0 —-<\/span>
[ 1] 22\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 2] 443\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 3] 53\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 4] 22\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 5] 1194\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 6] 22\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 192.168.1.0\/24<\/span>
[ 7] 22 (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[ 8] 443\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[ 9] 53 (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[10] 22\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[11] 1194\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span> <\/p>\n

\u5217\u51fa\u66f4\u8a73\u7d30\u7684\u8cc7\u8a0a
# ufw status verbose<\/span>
Status: active<\/span>
Logging: on (low)<\/span>
Default: deny (incoming), allow (outgoing), disabled (routed)<\/span>
New profiles: skip<\/span> <\/p>\n

To\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Action\u00a0\u00a0\u00a0\u00a0\u00a0 From<\/span>
—\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ——\u00a0\u00a0\u00a0\u00a0\u00a0 —-<\/span>
192.168.1.16 22\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 192.168.1.0\/24<\/span> <\/p>\n

6. \u522a\u9664\u9632\u706b\u7246\u5247
# ufw delete allow 22\/tcp<\/span>
# ufw delete allow from 192.168.1.0\/24 to 192.168.1.16 port 22<\/span>
# ufw delete 6<\/span>
Deleting:<\/span>
\u00a0allow from 192.168.1.0\/24 to any port 22<\/span>
Proceed with operation (y|n)? y<\/span><\/span>
Rule deleted<\/span> <\/p>\n

\u539f\u672c\u7b2c\u516d\u689d\u898f\u5247\u5df2\u522a\u9664
# ufw status numbered<\/span>
Status: active<\/span> <\/p>\n

\u00a0\u00a0\u00a0\u00a0 To\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Action\u00a0\u00a0\u00a0\u00a0\u00a0 From<\/span>
\u00a0\u00a0\u00a0\u00a0 —\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ——\u00a0\u00a0\u00a0\u00a0\u00a0 —-<\/span>
[ 1] 22\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 2] 443\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 3] 53\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 4] 22\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 5] 1194\/tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere<\/span>
[ 6] 22 (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[ 7] 443\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[ 8] 53 (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[ 9] 22\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span>
[10] 1194\/tcp (v6)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALLOW IN\u00a0\u00a0\u00a0 Anywhere (v6)<\/span><\/p>\n

7. \u6e05\u9664\u6240\u6709\u7684\u898f\u5247
# ufw reset<\/span>
Resetting all rules to installed defaults. This may disrupt existing ssh<\/span>
connections. Proceed with operation (y|n)?<\/span> y<\/span>
Backing up ‘after.rules’ to ‘\/etc\/ufw\/after.rules.20161225_095230’<\/span>
Backing up ‘after6.rules’ to ‘\/etc\/ufw\/after6.rules.20161225_095230’<\/span>
Backing up ‘user.rules’ to ‘\/etc\/ufw\/user.rules.20161225_095230’<\/span>
Backing up ‘before.rules’ to ‘\/etc\/ufw\/before.rules.20161225_095230’<\/span>
Backing up ‘user6.rules’ to ‘\/etc\/ufw\/user6.rules.20161225_095230’<\/span>
Backing up ‘before6.rules’ to ‘\/etc\/ufw\/before6.rules.20161225_095230’<\/span><\/p>\n

8. \u555f\u7528\u65e5\u8a8c\u529f\u80fd\uff1a
# ufw logging on<\/span>
Logging enabled<\/span> <\/p>\n

\u505c\u7528\u65e5\u8a8c\u529f\u80fd\uff1a
# ufw logging off<\/span>
Logging disabled<\/span> <\/p>\n

\u65e5\u8a8c\u9810\u8a2d\u6703\u5b58\u5728 \/var\/log\/ufw.log<\/span> <\/p>\n

\u8a2d\u5b9a\u65e5\u8a8c\u7684\u5c64\u7d1a(\u9810\u8a2d\u662f low)
# ufw logging (low | medium | high | full)<\/span><\/p>\n

10. \u76f4\u63a5\u4fee\u6539\u9810\u8a2d\u898f\u5247 \/etc\/ufw\/before.rules<\/span>
\u62d2\u7d55 Ping
# sed -i ‘34,38 s\/ACCEPT\/DROP\/’ \/etc\/ufw\/before.rules<\/span><\/p>\n

\u91cd\u65b0\u8f09\u5165
# ufw reload<\/span>
Firewall reloaded<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u5b89\u88dd ufw \u5957\u4ef6 # apt-get install ufw \u8a2d\u5b9a ufw (0.35-0ubuntu2) … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008Ubuntu Server ufw Firewall\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[119],"tags":[],"class_list":["post-19360","post","type-post","status-publish","format-standard","hentry","category-c-78464"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["680580"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19360"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19360"}],"version-history":[{"count":0,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19360\/revisions"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}