2

The tutorial for fwknop says to block ports with an iptables script.

I don't want to use iptables since it's too confusing, I'd rather use ufw. But it seems like ufw does some complicated stuff, so I'm not sure if fwknop needs to be separately configured for this.

If I open/close my ports with ufw, will fwknop still work as if I had closed them with iptables?

1

1) From fwknop documentation:

The fwknop project supports four different firewalls: iptables, firewalld, PF, and ipfw across Linux, OpenBSD, FreeBSD, and Mac OS X. There is also support for custom scripts so that fwknop can be made to support other infrastructure such as ipset or nftables.

So clearly, it officially supports 4 firewalls only. But there is room to add support for any other firewall manually. Do check the configuration file for more.

2) If you have UFW, then you also have iptables.

The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls. ufw provides a framework for managing netfilter, as well as a command-line interface for manipulating the firewall. ufw aims to provide an easy to use interface for people unfamiliar with firewall concepts, while at the same time simplifies complicated iptables commands to help an adminstrator who knows what he or she is doing. ufw is an upstream for other distributions and graphical frontends.

So if you block the ports by ufw it should work as though it were blocked by iptables itself. But to be honest, iptables is not that difficult to learn. To get you started, you only need to add the following rules to use fwknop.

# Generated by iptables-save v1.6.1 on Tue Apr 23 15:11:27 2019
*nat :PREROUTING ACCEPT [129:17936] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [106:9180] :POSTROUTING ACCEPT [106:9180] COMMIT
# Completed on Tue Apr 23 15:11:27 2019
# Generated by iptables-save v1.6.1 on Tue Apr 23 15:11:27 2019
*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [91:9203]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG
-A INPUT -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j LOG
-A FORWARD -j DROP COMMIT
# Completed on Tue Apr 23 15:11:27 2019

Just save the above text in any file. Then run the command:

iptables-restore < filename

You will be good to go!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.