I'm new to UFW. One of our servers were compromised and I had to immediately:
- Deny all inbound.
- Deny all outbound.
- Allow all SSH.
- Allow outbound DNS.
- Allow Git clone, push, pull, etc.
- Allow only inbound HTTP/S (80 & 8081, 443). Outbound HTTP/S that originate from the server should be blocked.
- Allow MySQL to only connect to 127.0.0.1 or localhost and block all incoming MySQL.
I realize some of those rules are strange but this is what I was asked to do. I realized I'm actually not sure how to do some of them in UFW.
Here's what I have:
# Deny all outgoing. ufw default deny incoming # Deny all outgoing. ufw default deny outgoing # Allow outgoing DNS. ufw allow out 53 # Allow SSH. ufw allow 22 # Allow outbound Git (I need to be able to clone, pull, push, etc). ufw allow out 9418/tcp # Allow only incoming HTTP on port 80 and 8081 without outbound. # Allow only incoming HTTPS on port 443 without outbound. ufw allow in to any port 80 proto tcp # Allow MySQL to connect to localhost only. ufw allow from 127.0.0.1 to 127.0.0.1 port 3306 proto tcp
After I run the above, I can:
curl --request GET 'http://foo.bar'to send an HTTP request to another site. I need to deny HTTP requests that originate from within the server.
- NOT clone with Git. It just hangs.
I haven't tested MySQL yet but it shouldn't be allowed to connect to anything but
What do I need to change to have it behave the way I want it to?