UFW – How to Check if a Rule is Reboot-Safe

firewallufw

So I have just added a firewall rule using ufw. How do I know whether I have to do additional steps to make this rule also automatically present after reboot?

(2nd question, but less important to me: If they are needed, which steps?)

For example: Do I have to check for installed/enabled/configured iptables-save? Do I have to put the rule into /etc/ufw/? (where?) Is there a rule like: If I am using Ubuntu, then ufw will always remeber state after reboot?

I am not used to work with ufw or iptables-save. I just read rumors in forums and the man page for ufw.

If you have to assume an operating system for your answer then please assume Ubuntu 16.04.

Best Answer

ufw doesn't make a distinction between the running state of the firewall and the permanent saved state. All rule changes take effect immediately and are persistent.

Related Solutions

How to temporarily open a port in ufw for a specific IP address

In my opinion a better solution would be to use port knocking, basically you would have "knock" a series of random ports that would then trigger an action on the server, the action would be to allow your IP address to SSH in. You can even setup a timeout so after a while the port would be closed.

For port knocking you could use knockd. You need a knock client too on the other side of course. A knockd config would look like this:

[options]
   logfile = /var/log/knockd.log

[SSH]
  sequence    = 7000,8000,9000
  seq_timeout = 5
  start_command = ufw allow from %IP% to any port 22
  tcpflags    = syn
  cmd_timeout   = 10
  stop_command  = ufw delete allow from %IP% to any port 22

Ubuntu – Connection refused on port 8100

With iptables the first match wins, so,

-A INPUT -j REJECT --reject-with icmp-port-unreachable

Everything below that line in the INPUT will be rejected and you will get a Connection Refused message

Look what's below it

-A INPUT -p tcp -m tcp --dport 8100 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8100 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Q.E.D.

Best Answer

Related Solutions

How to temporarily open a port in ufw for a specific IP address

Ubuntu – Connection refused on port 8100

Related Topic