Now we've added in a basic rule for SSH,
but that's allowing SSH traffic from any protocol,
IPv4 or IPv6, to access our system from any interface or address range.
If we only wanted, let's say coming in from our VirtualBox NAT network,
we could then add a rule like this.
This is adding to the allow rules.
We can then go through and take a look at the numbers of our rules,
and we can then delete rules by their number.
We can do a dry run first so it would show me what it's going to
do before, then if I'm happy with the results to go ahead and
actually run the deletion itself.
And we can always go through and double‑check with the status afterwards.
Now if we want to tune our connections,
allowing only inbound IPv4 SSH traffic and only from the correct network,
then we're going to go through and do this from our command line.
We're going to be working to customize our SSH needs,
adding a rule from our address range, using a dry‑run to test deletions,
and removing an IPv6 allow rule.
We're also then removing the allow from anywhere rule and
testing access then from different networks.
So if I go through and look at the status,
we can see then that we're allowing both TCP SSH traffic from IPv6 and IPv4.
Now, if we only know about IPv4, let's just manage about IPv4.
If we are expecting v6 traffic, then certainly allow it,
but we are allowing it from Anywhere.
When I take a look at my ip ‑4 and address show, I've got two interfaces.
I only need the traffic coming from the 10.0.2.15 network,
so I can go through and allow that network.
I don't need to allow SSH for anything else.
So we can make our system a little bit more secure. So I'm
going to make sure that it is allowed from my network, so
ufw allow from 10.0.2.0/24.
Make sure you're putting in the right network for the
interface that you want to allow.
I'm connecting from my host system via SSH into the system, and
that's coming in from the 10.0.2.0 network to any port, so long
as it's destined for port 22.
So that rule now has been added.
If I go through and look at the numbering, so if I go through and take a look
at my status, but taking a look at that numbered output,
we can see the rules that I've got in place.
I can go ahead and I could delete straight away, but I could also go
through and do a dry‑run to see what would happen.
We got a lot of information, which is quite useful, so I can see,
let's say if I want to remove rule number 3,
we're going to be able to see that really is the v6 rule. So we can go
through and do a delete 3. So I can prompt to go ahead, remember, it's
not actually going to do anything. And then we can go through and start
seeing the raw data of the rules that have been removed. But when we
look at it, it's all to do with ufw6. So nothing will have been
completed at this stage.
If I go through and look at the status and all of those rules are still there.
A dry‑run literally is what it says.
But if I then go through and remove the dry‑run, I can delete then my rule 3,
and I also want to delete the rule 1, the allow from anywhere.
So I'm just going to go straight ahead and delete that. With all
of that done, checking the status now, we can see that we are
allowing from the 10.0.2.0 network.
So if I jump out through to my AlmaLinux 8 system and then if we try an ssh
192.168.33.13, that's the IP address of my Ubuntu system,
we can see that we are not getting through. To double‑check that it
really is working on this system, if I exit out, so I'm back on my host,
if I then use vagrant ssh ubuntu, it will be using then the 10 network.
We should be allowed to use this, and we should gain access then through
to our system. And we can see then that I'm still able to ssh in from
the 10 network.
So we're much better at meeting the rules that we want.
And if I go through and take a look at the ufw and status now,
we can see then that we've got just the one rule allowing IPv4
traffic into SSH, but only from the 10 network.
And we verified that we can connect in from the 10 network and we can't connect in from the 192.168.33 network.