• What is a firewall?
  A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on a set of 'rules' that the SysAdmin sets up. We can imagine the firewall as a barrier between a trusted internal network and untrusted external network, such as the Internet. Believe me, Internet isn't secure at all!There are two form of firewall:
  • Hardware firewall, a dedicated device used by enterprises that it is usually located between the routers, which communicates with Internet, and the switches. Its role is to manage the connection to the DMZ by the customers, think about public services such as website/blog for example, and monitoring and protect the remote access to the company internal network. We can say that it operates over all the company network. I will not deep-in on enterprise networking because it is a very interesting but complex topic, that myself studied on the last year of high school so I am not a expert.
    
  • Software firewall or Personal firewall, is a software which controls network traffic to and from a computer, thus it usually protects only the computer on which it is installed. Typically it works as an application layer firewall*.
    On this tutorial we will focus on software firewall.
    
• How it works and why it is so important?
  We can identify two types of firewall operation:
  • Packet filtering: the firewall reads up all the packets' metadata that are passing via your network interface, if some metadata matches a rules then the firewall will act. All firewalls can do this. It is done at the network layer.
    
  • "Data validation": the firewall doesn't just read the packets' metadata; it will also look at the actual data transported. It knows how certain protocols work, for example FTP or HTTP. If the data that is in the packet is not valid for that protocol the packet will be dropped.
    
  We are talking about rules, we already said that they are made by SysAdmin, but what are they? Well, to put is simple they are a pair < ACTION , SUBJECT > where:
  • ACTION: can be set to "allow" or "deny" and it indicates the behavior of the firewall;
    
  • SUBJECT: it can be a web port, a ip address or, for some particular firewall, an application target. It indicates to who the rule will be applied.
    
  You can now understand why firewall is so important, with it we can manage all the outgoing and incoming traffic of our server: every packet that tries to get out/in needs firewall's approval.Good practices tells us to deny all the incoming traffic and allow all the outgoing traffic, we will then create rules to allow specific incoming traffic such as SSH (port 22), HTTP (port 80), HTTPS (port 443), Mailing (port 25).
  
• Why UFW?
  UFW (Uncomplicated firewall) is a wrapper for IPTABLES. A wrapper is a software that provides a easy commands for a more complex tool. If you are interested on IPTABLES, @"Hidden Refuge" made a thread about a basic usage of it.
  I think that UFW is very simple and easy to learn. It is not perfect, it has its own limitation but for general firewall usage works!
  

• UBUNTU: If you are using Ubuntu Server, then you have already installed it. Nothing to do.
  
• CentOS: If you are running CentOS you have probably installed FirewallD, we need to stop its service, if enabled, and install UFW:
  • First, we need to stop, if running, the firewallD service. The following command will do that:
    
    Code:

    systemctl stop firewalld
  • With the following command you will disable to boot load, if enabled, of the FirewallD service:
    
    Code:

    systemctl disable firewalld
  • Now, UFW is available on the  EPEL repository so we need to install it with the following command:
    
    Code:

    yum install -y epel-release
  • Finally, we can install UFW with the following command:
    
    Code:

    yum install -y ufw

• First, we use a UFW command that should start and enable boot load:
  
  Code:

  ufw enable
• It can happen that the previous command doesn't enable the boot load, so to make sure it is enable run:
  
  Code:

  systemctl enable ufw

• To see the current status and which rules are up, use the following command:
  
  Code:

  ufw status
• For good practice we will block incoming traffic and allow outgoing:
  • [*}To deny all the incoming traffic, run the following command:
    Code:

    ufw default deny incoming
    [*}To allow all the outgoing traffic, run the following command:
    
    Code:

    ufw default allow outgoing
• To allow/deny a specific port, run the following command:
  
  Code:

  ufw [allow/deny] [port]/[protocol: "tcp" or "udp", default=tcp]
• To allow/deny a range of ports, run the following command:
  
  Code:

  ufw [allow/deny] [fisrt_port]:[last_port]/[protocol: "tcp" or "udp", default=tcp]
• To allow/deny all the connections from a specific STATIC IP, run the following command:
  
  Code:

  ufw [allow/deny] from [IP]
• To allow/deny the connections on a specific port from a specific STATIC IP, run the following command:
  
  Code:

  ufw [allow/deny] from [IP] to any port [port]
• To delete a rule, you need to know its index using the following command:
  
  Code:

  ufw status numbered
  Now you can delete the rule with the following command:
  
  Code:

  ufw delete [index]
• If you want to stop the firewall for a moment, run the following command:
  
  Code:

  systemctl stop ufw
• If you want to start the firewall after running the previous command, run the following command:
  
  Code:

  systemctl start ufw
• If you want to disable the boot load of the firewall, run the following command:
  
  Code:

  systemctl disable ufw

• If you want to see your app list, use the following command:
  
  Code:

  ufw app list
• If you want to see more information about an app, use the following command:
  
  Code:

  ufw app info 'APP_NAME'
• If you allow/deny a specific app profile, use the following command:
  
  Code:

  ufw [allow/deny] 'APP_NAME'
• To allow/deny an app profile for a specific STATIC IP, run the following command:
  
  Code:

  ufw [allow/deny] from [IP] to any app 'APP_NAME'
• If you want to delete an enabled app profile, just follow the same steps to delete a rule.
  

(09-16-2019, 01:06 PM)rudra Wrote: I was sincerely hoping that you would do a bare bones iptables tutorial. But oh well.. not all our wishes come true.

This is a good tutorial. But you kind of crammed everything back to back. Could you please do a section where you write the instructions that a new vps user could follow to secure his new setup; with some explanations of course. Hope you get what i am talking about.