sudo apt-get install gufw
|This documentation explains how to use Gufw in Ubuntu 9.10 Karmic Koala, which is still under development. The concepts are backwards compatible with stable Ubuntu versions, though the screenshots may vary a bit.|
To access GUFW, go to System->Administration->Firewall configuration. By default, the firewall is disabled.
To enable the firewall, simply check the Enabled box and the default for traffic will be set to Deny.
To configure the firewall, we add rules. Simply click the Add button and a new window will pop up. For details about this implementation, see the UFW page. Rules can be configured for TCP and UDP ports, and UFW has some preconfigured programs/services to make setting up rules for them easy. The available options for rules are Allow, Deny, Reject, and Limit:
- Allow: The system will allow entry traffic for a port.
- Deny: The system will deny entry traffic to a port.
- Reject: The system will deny entry traffic to a port and will inform the requesting for connection system that it has been rejected.
- Limit: The system will deny connections if an IP address has attempted to initiate 6 or more connections in the last 30 seconds.
The Preconfigured tab gives us some options for controlling firewall options for common programs and services. A prime example is given on the UFW page, which is allowing and denying the ssh service, which uses port 22. If you select "Allow", "Service", "ssh", then the firewall will be configured to allow SSH traffic.
Not all program configurations are available in Gufw, but we can still add rules for them using the Simple tab. Again, we'll use the SSH example - let's just pretend for a moment that there isn't a preconfigured option for it. To enable it in the Simple tab, select "Allow", "TCP", "22" and click Add.
Sometimes we want to configure access based on specific IPs or IP ranges, so we use the Advanced tab. Back to the SSH example, let's say we only want to enable access for users on the local LAN, using IPs 192.168.1.100 - 192.168.1.150. Your options would be "Allow", "TCP", From: "192.168.1.100"/"22", To: "192.168.1.150"/"22".
There are only a couple of preferences available to set in Gufw, and can be controlled from Edit->Preferences Here you can control logging for ufw and for Gufw. The default is to enable logging for ufw, and disable logging for Gufw.