1

I'm new to UFW. One of our servers were compromised and I had to immediately:

  • Deny all inbound.
  • Deny all outbound.
  • Allow all SSH.
  • Allow outbound DNS.
  • Allow Git clone, push, pull, etc.
  • Allow only inbound HTTP/S (80 & 8081, 443). Outbound HTTP/S that originate from the server should be blocked.
  • Allow MySQL to only connect to 127.0.0.1 or localhost and block all incoming MySQL.

I realize some of those rules are strange but this is what I was asked to do. I realized I'm actually not sure how to do some of them in UFW.

Here's what I have:

# Deny all outgoing.
ufw default deny incoming

# Deny all outgoing.
ufw default deny outgoing

# Allow outgoing DNS.
ufw allow out 53

# Allow SSH.
ufw allow 22

# Allow outbound Git (I need to be able to clone, pull, push, etc).
ufw allow out 9418/tcp

# Allow only incoming HTTP on port 80 and 8081 without outbound.
# Allow only incoming HTTPS on port 443 without outbound.
ufw allow in to any port 80 proto tcp

# Allow MySQL to connect to localhost only.
ufw allow from 127.0.0.1 to 127.0.0.1 port 3306 proto tcp

After I run the above, I can:

  1. use curl --request GET 'http://foo.bar' to send an HTTP request to another site. I need to deny HTTP requests that originate from within the server.
  2. NOT clone with Git. It just hangs.

I haven't tested MySQL yet but it shouldn't be allowed to connect to anything but 127.0.0.1 and localhost.

What do I need to change to have it behave the way I want it to?

1

You need to allow incoming on the ports you opened, not just outgoing. Otherwise the destination server will not be able to send you a response. If you notice, your ssh works because you're allowing incoming and outgoing. GIT does not work because you're blocking the response from the remote server. DNS is probably broken as well.

MySQL: by default your my.cnf should not allow remote connections; you usually have to explicitly allow it in the bind-address.

  • +1 for the my.cnf suggestion. That's what I should have done. I want to block outgoing HTTP requests that originate from within the server. We suspect that some sites have been compromised and are sending out HTTP requests. How can I stop those? I'll edit my question to specify that they originate from the server. Also, how can I modify my rules to allow Git? – Housni Jan 29 '16 at 18:54
  • I don't have a Linux box in front of me, but try changing your GIT rule to "ufw allow 9418/tcp". Should allow incoming and outgoing. You should be blocking outgoing http requests already with your default outgoing rule (no other rule matches the port so default should apply). – vik Jan 29 '16 at 18:57
  • I'm not sure why you'd want to allow incoming requests to http on the server but block outgoing; you might as well just block port 80 completely as you won't get a response from the server. – vik Jan 29 '16 at 19:03
  • I believe the correct syntax is ufw allow proto tcp from any to any port 9418 but that didn't solve the problem. I also set ufw allow 53 but now I get a ssh: Could not resolve hostname github.com: Temporary failure in name resolution when I try to clone. Oh, I don't want to block responses, I only want to block connections that originate from the server. Maybe I was explaining it wrong....so, cURL shouldn't be able to send a GET request to Google.com but Google should get a response from my server, if Google sent a request. – Housni Jan 29 '16 at 19:08
  • 1
    github won't resolve because you're blocking DNS incoming. OK, try "ufw allow 53/tcp" and "ufw allow 53/udp" and see what happens. – vik Jan 29 '16 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.