Set up a firewall with ufw

ufw ("uncomplicated firewall") is a simple front end for the Linux firewall. It comes with Ubuntu; on Debian you install it. This guide blocks everything that comes in except the ports you choose.

Install ufw#

sudo apt update
sudo apt install ufw

Allow SSH before anything else#

1. Allow SSH. If your SSH server listens on another port than 22, use that number:

   Copier

   sudo ufw allow 22/tcp
   

   Instead of allow, you can use limit: ufw then blocks an address that opens 6 or more connections within 30 seconds.

   Copier

   sudo ufw limit 22/tcp
   

2. If you always connect from one fixed IP address, you can allow SSH from that address only. Replace 203.0.113.10 with yours:

   Copier

   sudo ufw allow proto tcp from 203.0.113.10 to any port 22
   

   Do this only with an address that does not change, or you lock yourself out when it does.

Set the default rules#

Block everything that comes in, and allow everything that goes out:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Open the ports you need#

Open only what your server offers to the outside. Some examples:

Wings must be reachable from the internet, not only from the panel: the browsers of your panel users connect to it directly, for example for the console. Port 80 must also be open if you get certificates with certbot's HTTP challenge.

Turn on the firewall#

1. Check your rules before you turn it on:

   Copier

   sudo ufw show added
   

   Make sure the SSH rule is there.

2. Turn it on. ufw asks for confirmation because you are connected over SSH:

   Copier

   sudo ufw enable
   

3. Test from a new SSH session that you can still log in.

4. See the active rules:

   Copier

   sudo ufw status verbose
   

Remove a rule#

1. List the rules with numbers:

   Copier

   sudo ufw status numbered
   

2. Remove one by its number:

   Copier

   sudo ufw delete 3
   

   The numbers shift after every removal, so list them again before you remove the next one.

To try a change without applying it, add --dry-run, for example sudo ufw --dry-run allow 443/tcp.

Docker ports are not covered by ufw#

According to the Docker documentation, when a container publishes a port, its traffic is diverted before it reaches the ufw rules. A deny rule in ufw does not close a port that Docker publishes, and you do not need an allow rule to open one.

For a Pterodactyl node this means:

• the ports of your game servers (the allocations) are published by Docker and are reachable whatever ufw says;
• to keep a container port private, publish it on 127.0.0.1 only, or do not publish it at all.

If you locked yourself out#

Use the web console or rescue mode of your server provider to log in, then run:

sudo ufw allow 22/tcp

Or turn the firewall off until you have fixed the rules:

sudo ufw disable

To also block repeated failed logins, see secure SSH on your server.