001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
|
<?php
HowTo: UFW ) Block Outgoing Ports Except Those Needed + More in Ubuntu 11.10
Contents -
Part 1: (. Novice .) - Block Outgoing Ports Except Those Needed
allow: 20-21, 53, 80, 123, 443 outgoing only
Part 2: (. Moderate .) - Sysctl: configure kernel parameters at runtime
Part 3: (. Moderate .) - Configuring before*.rules
Part 4: (. Advanced .) - Blocking Private Networks
###################################################
Part 1: (. Novice .) - Block Outgoing Ports Except Those Needed
allow: 20-21, 53, 80, 123, 443 outgoing
I have tested this at the command line and it works. Here
are the instructions on how to block outgoing ports except
those specified using ufw at the command line. This guide
assumes you have previously modified /etc/ufw/ufw.conf
to enable auto-launching on system startup and ufw is
running.
This configuration will allow the following outbound ports:
20-21, 53, 80, 123, 443 which is all that is required for
many users. The outbound port mapping may be customized
by you for your setup if it's your desire for allowing
other applications using different ports. This guide
does not cover configuration of apps which would reside
in /etc/ufw/applications.d
1. Open a Terminal window
2. With ufw started and configured for system startup
with the default inbound deny, begin:
sudo ufw deny out 1:19/tcp
sudo ufw deny out 1:19/udp
sudo ufw deny out 22:52/tcp
sudo ufw deny out 22:52/udp
sudo ufw deny out 53:79/tcp
sudo ufw deny out 53:79/udp
sudo ufw deny out 81:122/tcp
sudo ufw deny out 81:122/udp
sudo ufw deny out 124:442/tcp
sudo ufw deny out 124:442/udp
sudo ufw deny out 444:65535/tcp
sudo ufw deny out 444:65535/udp
3. Check your work in one or two ways:
sudo ufw status verbose
sudo ufw status numbered
Configuration is complete. To test this configuration
you may start applications requiring the use of another
port, such as a torrent application and when it fails
to function, your leak test is a success. If you prefer
retaining the above configuration, you may customize
applications which allow it to use ports 80 or 443 to
function. Or, you may prefer to redo the above differently
with your own port range to allow for ports you need
open.
I wrote this post because I couldn't find the information
on-line on blocking outbound, or the information found was
in error for the current version of Ubuntu 11.10. Or, there
were posts where users *wanted* this functionality but
people would post back unhelpful information in different
ways, including but not limited to, "You don't need to
do this." Yes, some would like this functionality, otherwise
they wouldn't have asked for the information!
When you've finished using the sudo command in your
Terminal, close it out with:
sudo -K
followed by:
exit
If you're continuing to use sudo for other operations
at the command line, don't type sudo -K until you've
finished.
One example of an application which may be customized for
this setup is Vidalia/Tor:
- Open Vidalia's Control Panel and click on Settings.
- Now click on the Network Icon.
- Next, click the box which says, "My firewall only lets
me connect to certain ports - Firewall Settings", from
here it should say 80,443 by default, you're done here,
click OK.
When you reload Vidalia/Tor, it will have
written those port settings to the Tor configuration
file and it will launch using the above two ports only.
This is very useful when running Tor if you want an
outbound blocking policy in ufw, as Tor by default
connects to several different ports and it would be
impossible to configure them all, as they change
per Tor node(s).
###################################################
Part 2: (. Moderate .) - Sysctl: configure kernel parameters at runtime
This is interesting in Ubuntu 11.10, as Sysctl is
found/referenced in three different locations:
/etc/sysctl.conf
/etc/sysctl.d/ (contains a few files)
/etc/ufw/sysctl.conf
Within /etc/ufw/sysctl.conf it reads:
"Please note these settings override /etc/sysctl.conf and
/etc/sysctl.d. If you prefer to use /etc/sysctl.conf,
please adjust IPT_SYSCTL in /etc/default/ufw."
Let's start by modifying /etc/default/ufw, use one
of the two options, nano if you're comfortable
with using nano, or gedit if you'd rather use a graphical
editor:
For nano copy/paste: sudo nano /etc/default/ufw
For gedit copy/paste: gksudo gedit /etc/default/ufw
Modify the following section to match this value:
# IPT backend
# only enable if using iptables backend
IPT_SYSCTL=/etc/sysctl.conf
Save document and exit.
We've changed the default setting to specify
the use of /etc/sysctl.conf here.
Now we modify the /etc/sysctl.conf file. Start
the editor you wish to use, nano or gedit:
sudo nano /etc/sysctl.conf
gksudo gedit /etc/sysctl.conf
* Uncomment (remove the '#' before each line) the
following sections: (these are my recommended settings)
If you prefer, you could simply copy/paste these
lines into /etc/sysctl.conf rather than hunting down
each section for uncommenting, it's faster:
kernel.printk = 3 4 1 3
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
* Copy/paste the following into /etc/sysctl.conf:
#from /etc/sysctl.d
kernel.kptr_restrict = 1
kernel.yama.ptrace_scope = 1
vm.mmap_min_addr = 65536
* Copy/paste the following into /etc/sysctl.conf:
#from /etc/ufw/ directory
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.icmp_echo_ignore_all=0
Save the document and exit, now copy/paste at
the command line:
sudo sysctl -p
and you're done with the sysctl configuration!
If you know what you're doing, you may alter
the configuration above, but know what you're
doing before you add anything further, or
subtract from my recommended settings.
References:
- https://en.wikipedia.org/wiki/Sysctl
After completion:
sudo ufw disable
sudo ufw enable
When you've finished using the sudo command in your
Terminal, close it out with:
sudo -K
followed by:
exit
If you're continuing to use sudo for other operations
at the command line, don't type sudo -K until you've
finished.
###################################################
Part 3: (. Moderate .) - Configuring before*.rules
I won't elaborate on the purpose of this section,
it should become obvious should you read the files.
The following are my recommendations:
sudo nano /etc/ufw/before.rules
or: gksudo gedit /etc/ufw/before.rules
under #ok icmp codes
comment all entries in this section by adding
a # mark at the beginning of each line. There's
no reason for my computer to allow icmp. I don't
care what someone else says or why, this is my
preference, ignore me here if your preferences
are different.
under #allow dhcp to work
comment out the line if your system is setup
for static ip use, if your system needs dhcp
for networking, do not comment this section,
leave it as-is.
under #allow MULTICAST mDNS for service discovery
comment out the line
under #allow MULTICAST UPnP for service discovery
comment out the line
Save file and exit
Repeat the above configuration modifications to
the file before6.rules, loading it with nano
or gedit, save and exit.
After completion:
sudo ufw disable
sudo ufw enable
When you've finished using the sudo command in your
Terminal, close it out with:
sudo -K
followed by:
exit
If you're continuing to use sudo for other operations
at the command line, don't type sudo -K until you've
finished.
###################################################
Part 4: (. Advanced .) - Blocking Private Networks
I assume you know what you're doing in this portion
of the guide. If you do not, please skip this section.
To block private networks (including the pesky multicast
if you don't need it) this works, but look out for the
192.168.0.0/16 which may be your local private network
and shouldn't be blocked.
Subsection 2(1): Blocking Private Networks: [1]
sudo ufw deny out to 10.0.0.0/8
sudo ufw deny out to 172.16.0.0/12
sudo ufw deny out to 192.168.0.0/16
2(1),[1] References:
- https://en.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces
- https://tools.ietf.org/html/rfc1918
Subsection 2(2): Blocking MULTICAST: [2] [2/I]
sudo ufw deny out to 239.0.0.0/10 (or 239.0.0.0/8)
sudo ufw deny out to 224.0.0.0/4
2(2),[2] References:
- https://en.wikipedia.org/wiki/Multicast_address
- https://www.ietf.org/rfc/rfc2365.txt
2(2),[2/I] Information: Google about MULTICAST and
many users on the web experiencing flooding from
their routers with messages in their log from
these addresses frustrating them. You may ignore
these messages if you see them in your logs by
backtracking to Part 2 in this guide above,
and modifying the line within /etc/sysctl.conf
to: net.ipv4.conf.all.log_martians = 0
instead of the value = 1. Personally, I like
seeing martians logged, you may not, for
reasons of sanity when combing log files
and disk space.
When you've finished using the sudo command in your
Terminal, close it out with:
sudo -K
followed by:
exit
If you're continuing to use sudo for other operations
at the command line, don't type sudo -K until you've
finished.
?>
|