Cyberstudy
Supplementary — not from your PDF Intermediate ~35 min

Configure a host firewall (default deny)

Lock down a practice VM with ufw: block all inbound traffic except SSH from your lab network, then check what's allowed.

Environment

A Linux VM on your host-only practice network (see 'Build an isolated practice network').

Before you start

  • Read Firewalls (p.132), Layer 4 and Layer 7 Firewalls (p.134) and Access Control Lists (p.252).

You will

  • Write an implicit-deny rule set
  • Allow one service from one subnet
  • Read and order firewall rules

Steps

  1. 1

    Install ufw if needed: sudo apt install ufw.

  2. 2

    Set the defaults: sudo ufw default deny incoming and sudo ufw default allow outgoing.

  3. 3

    Allow SSH only from your lab subnet: sudo ufw allow from 192.168.56.0/24 to any port 22 proto tcp.

  4. 4

    Enable it: sudo ufw enable, then list the rules with sudo ufw status numbered.

  5. 5

    From your second VM, ssh into this one. It should connect.

  6. 6

    Add a web server (sudo apt install nginx) and check from VM 2 with curl http://<vm1-ip>. It's blocked. Then add sudo ufw allow from 192.168.56.0/24 to any port 80 proto tcp and try again.

  7. 7

    Read sudo ufw status verbose and explain the order in which rules are applied.

Check your understanding

  • ?Which rule gives you 'implicit deny'?
  • ?Is ufw a layer 4 or a layer 7 firewall? What couldn't it inspect?
  • ?Why restrict SSH by source subnet as well as by port?