BRRABill's Field Report With Linux

@dafyre said in BRRABill's Field Report With Linux:

I'll likely keep typing it until it starts saying:

"Command not found, use ip addr, ya idjit"

You can fix that with an alias.

True. But at that point, I'd likely just sigh and type the correct command.

BRRABill

QOTD:

So I installed Ubuntu 16.10 yesterday to set up a Unifi cloud controller.

I followed some pretty simple directions here which had me "setup the iptables" firewall.
https://community.ubnt.com/t5/UniFi-Wireless/Step-by-Step-Walkthrough-Set-up-Unifi-Cloud-Controller-v-4-7-6/td-p/1324666

But I have seen most articles reference ufw as the firewall in Ubuntu, a "front end" for iptables.

So, can someone explain what the heck these two things are? Are they two separate things that should not be used together?

ufw was installed but not enabled on my install. Is iptables enabled by default on fresh installs?

travisdh1

@BRRABill said in BRRABill's Field Report With Linux:

QOTD:

So I installed Ubuntu 16.10 yesterday to set up a Unifi cloud controller.

I followed some pretty simple directions here which had me "setup the iptables" firewall.
https://community.ubnt.com/t5/UniFi-Wireless/Step-by-Step-Walkthrough-Set-up-Unifi-Cloud-Controller-v-4-7-6/td-p/1324666

But I have seen most articles reference ufw as the firewall in Ubuntu, a "front end" for iptables.

So, can someone explain what the heck these two things are? Are they two separate things that should not be used together?

ufw was installed but not enabled on my install. Is iptables enabled by default on fresh installs?

iptables is the user-space application to configure the tables kernel firewall. Almost every Linux based firewall app uses iptables in the background to do it's work. So this ufw is just another way to manage the firewall. Leave it to Ubuntu to do something odd.

I'd hope a firewall is enabled by default, that it's missing as default in CentOS7-1511 is super annoying.

BRRABill

@travisdh1 said in BRRABill's Field Report With Linux:

@BRRABill said in BRRABill's Field Report With Linux:

QOTD:

So I installed Ubuntu 16.10 yesterday to set up a Unifi cloud controller.

I followed some pretty simple directions here which had me "setup the iptables" firewall.
https://community.ubnt.com/t5/UniFi-Wireless/Step-by-Step-Walkthrough-Set-up-Unifi-Cloud-Controller-v-4-7-6/td-p/1324666

But I have seen most articles reference ufw as the firewall in Ubuntu, a "front end" for iptables.

So, can someone explain what the heck these two things are? Are they two separate things that should not be used together?

ufw was installed but not enabled on my install. Is iptables enabled by default on fresh installs?

iptables is the user-space application to configure the tables kernel firewall. Almost every Linux based firewall app uses iptables in the background to do it's work. So this ufw is just another way to manage the firewall. Leave it to Ubuntu to do something odd.

I'd hope a firewall is enabled by default, that it's missing as default in CentOS7-1511 is super annoying.

The "odd" thing is that when I use ufw to list the rules in place (in iptables) nothing is listed.

Which makes me wonder if they are separate things...

travisdh1

@BRRABill said in BRRABill's Field Report With Linux:

@travisdh1 said in BRRABill's Field Report With Linux:

@BRRABill said in BRRABill's Field Report With Linux:

QOTD:

So I installed Ubuntu 16.10 yesterday to set up a Unifi cloud controller.

I followed some pretty simple directions here which had me "setup the iptables" firewall.
https://community.ubnt.com/t5/UniFi-Wireless/Step-by-Step-Walkthrough-Set-up-Unifi-Cloud-Controller-v-4-7-6/td-p/1324666

But I have seen most articles reference ufw as the firewall in Ubuntu, a "front end" for iptables.

So, can someone explain what the heck these two things are? Are they two separate things that should not be used together?

ufw was installed but not enabled on my install. Is iptables enabled by default on fresh installs?

iptables is the user-space application to configure the tables kernel firewall. Almost every Linux based firewall app uses iptables in the background to do it's work. So this ufw is just another way to manage the firewall. Leave it to Ubuntu to do something odd.

I'd hope a firewall is enabled by default, that it's missing as default in CentOS7-1511 is super annoying.

The "odd" thing is that when I use ufw to list the rules in place (in iptables) nothing is listed.

Which makes me wonder if they are separate things...

Wait... Ubuntu.... and more crazy Ubuntu type things. I don't think they enable the firewall by default. They say "Just don't run a service you don't need." instead, don't they?

BRRABill

@travisdh1 said

Wait... Ubuntu.... and more crazy Ubuntu type things. I don't think they enable the firewall by default. They say "Just don't run a service you don't need." instead, don't they?

Well, that's part of m question as well.

From a little reading, it appears there is no firewall by default, because no ports are open.

But then all you have to do is add ports into iptables, and that enables it?

This is why I am confused.

travisdh1

@BRRABill said in BRRABill's Field Report With Linux:

@travisdh1 said

Wait... Ubuntu.... and more crazy Ubuntu type things. I don't think they enable the firewall by default. They say "Just don't run a service you don't need." instead, don't they?

Well, that's part of m question as well.

From a little reading, it appears there is no firewall by default, because no ports are open.

But then all you have to do is add ports into iptables, and that enables it?

This is why I am confused.

Nope. You want a web server on port 80, just install apache2. Done.

Dashrender

@BRRABill said in BRRABill's Field Report With Linux:

@travisdh1 said

Wait... Ubuntu.... and more crazy Ubuntu type things. I don't think they enable the firewall by default. They say "Just don't run a service you don't need." instead, don't they?

Well, that's part of m question as well.

From a little reading, it appears there is no firewall by default, because no ports are open.

But then all you have to do is add ports into iptables, and that enables it?

This is why I am confused.

No adding ports to iptables doesn't not enable it - you'd have to start the service that enables it, and then open the required ports (I suppose you could do it either one first, but if you don't enable the service, then there is no firewall running)

BRRABill

@Dashrender said i

No adding ports to iptables doesn't not enable it - you'd have to start the service that enables it, and then open the required ports (I suppose you could do it either one first, but if you don't enable the service, then there is no firewall running)

Are you sure about that?

iptables is just the interface to the firewall, which I think is always running.

Now, by default, it is allowing everything.

I set up another fresh droplet for testing, and this is what iptables -L gives me

Chain INPUT (policy ACCEPT)
Chain FORWARD (policy ACCEPT)
Chain OUTPUT (policy ACCEPT)

Dashrender

yep, I'm sure IF the following is correct and the firewall is not enabled by default as mentioned below.

@travisdh1 said in BRRABill's Field Report With Linux:

Wait... Ubuntu.... and more crazy Ubuntu type things. I don't think they enable the firewall by default. They say "Just don't run a service you don't need." instead, don't they?

BRRABill

@Dashrender said in BRRABill's Field Report With Linux:

yep, I'm sure IF the following is correct and the firewall is not enabled by default as mentioned below.

@travisdh1 said in BRRABill's Field Report With Linux:

Wait... Ubuntu.... and more crazy Ubuntu type things. I don't think they enable the firewall by default. They say "Just don't run a service you don't need." instead, don't they?

I think maybe what @travisdh1 meant was that it is enabled, but be default allows everything.

Hence, it seeming like it's not actually firewalling anything.

@travisdh1 ???

And where are all the Ubuntu experts here on ML???

BRRABill

So, in this fresh install, I tried adding a rule in ufw, and it added all sorts of stuff to iptables.

So maybe it works the one way, but not the other?

Dashrender

@BRRABill said in BRRABill's Field Report With Linux:

So, in this fresh install, I tried adding a rule in ufw, and it added all sorts of stuff to iptables.

So maybe it works the one way, but not the other?

that's completely possible. Unifi stuff is that way
you can update the device with a json file, but it won't update the GUI.

BRRABill

@Dashrender said in BRRABill's Field Report With Linux:

@BRRABill said in BRRABill's Field Report With Linux:

So, in this fresh install, I tried adding a rule in ufw, and it added all sorts of stuff to iptables.

So maybe it works the one way, but not the other?

that's completely possible. Unifi stuff is that way
you can update the device with a json file, but it won't update the GUI.

Actually the Unifi installer made NO changes to iptables.

BRRABill

I mean that adding in one rule in ufw (allwing SSH) added all this to the output of iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ufw-before-logging-input  all  --  anywhere             anywhere
ufw-before-input  all  --  anywhere             anywhere
ufw-after-input  all  --  anywhere             anywhere
ufw-after-logging-input  all  --  anywhere             anywhere
ufw-reject-input  all  --  anywhere             anywhere
ufw-track-input  all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
ufw-before-logging-forward  all  --  anywhere             anywhere
ufw-before-forward  all  --  anywhere             anywhere
ufw-after-forward  all  --  anywhere             anywhere
ufw-after-logging-forward  all  --  anywhere             anywhere
ufw-reject-forward  all  --  anywhere             anywhere
ufw-track-forward  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ufw-before-logging-output  all  --  anywhere             anywhere
ufw-before-output  all  --  anywhere             anywhere
ufw-after-output  all  --  anywhere             anywhere
ufw-after-logging-output  all  --  anywhere             anywhere
ufw-reject-output  all  --  anywhere             anywhere
ufw-track-output  all  --  anywhere             anywhere

Chain ufw-after-forward (1 references)
target     prot opt source               destination

Chain ufw-after-input (1 references)
target     prot opt source               destination
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-ns
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-dgm
ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn
ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootps
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootpc
ufw-skip-to-policy-input  all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST