Hello, and welcome to this Pluralsight presentation.
My name is Andrew Mallett, and I'm going to be your instructor as I
help guide you through the module, Implementing Firewalls with UFW.
As we work our way through the module,
we'll be taking a look at securing our system using host‑based
firewalls, and that firewall on Ubuntu is going to be UFW.
We're going to be taking a look at the defaults for the firewall,
we'll be configuring some of the basic rules before enabling our
service, and we'll be looking at different ways that we can enable,
disable, and reset our firewall.
So when we're ready, we're going to begin. Now, the
first thing to come across is UFW.
What does it stand for?
Well,
an Uncomplicated Firewall. But if I've ever heard an
oxymoron, UFW is going to be it.
There's really no such thing as an Uncomplicated Firewall,
but being a firewall management system,
it does take a lot of the heartache out for you.
The lab systems that we're using include the AlmaLinux 8 system, that's
going to be used as our client so we can test our rules.
We're using Ubuntu 20.04 to be our firewall host, running the UFW. Now
host‑based firewalls, we've talked about it before being part of our
security onion, another layer of security.
Now of course, we are going to have border gateways that protect our
internal network from the internet, but if there's a failure in those,
at least having a firewall that's protecting each of your hosts is that
second level of protection, as well as protecting against attacks from
the internal network.
UFW, or Uncomplicated Firewall, is the default firewall manager
installed with Ubuntu. We could if we wanted to also install firewalld,
but we're only going to need one firewall, so we'll be looking at the
default, UFW. When we look at managing UFW, we're going to gain our
administrative privileges. We can check its status, so ufw status, but
we could also add options to this, so we can get verbose output or
numbered output.
The numbered output can be really useful when we're
looking at deleting rules because we can delete rules
based on their number in the output.
Most firewall systems will have default rules.
The default rule in UFW is to block all incoming traffic. We can check any
of the defaults and other settings from etc/default/ufw.
The first thing that we're going to do before we enable is to
make sure that we're allowed SSH traffic through because, of
course, as soon as I enable my firewall,
if it's blocking SSH traffic, we could then lock myself out of the system.
We then go ahead and enable our system.
So I think the first thing that we need to do is find our command line, and
make sure we can understand these default settings, and making sure that we can configure our basic settings in a reliable manner.