Jinsi ya kutumia UFW kwenye VPS

UFW ni nini na kwa nini unaihitaji

UFW inamaanisha Uncomplicated Firewall, na jina hilo ni la kweli. Ni interface rahisi juu ya firewall ambayo Linux kernel tayari ina, hivyo badala ya kuandika sheria ngumu, unatumia amri fupi kama ufw allow 22/tcp. Kwenye VPS mpya, huduma yoyote inayosikiliza (listening) inaweza kufikiwa kutoka kwenye internet kwa kuanzia. Firewall inabadilisha hali hiyo: unakataa kila kitu, kisha unaruhusu bandari (ports) chache unazozitumia. Mabadiliko hayo pekee yanaondoa hatari nyingi kwa kutumia amri nne tu.

Kabla ya kuanza kuitumia, jua ni huduma gani zinazosikiliza, kwa sababu firewall huamua hatima ya huduma hizo. Kusoma kinachosikiliza kwa kutumia ss -tlnp ndiyo hatua sahihi ya kwanza.

Kanuni moja inayokuepusha na kujifunga nje ya mfumo

Hapa kuna kosa linalowatisha watu kuhusu firewalls. Unawasha UFW kwa sera ya default-deny, lakini hujaruhusu SSH, hivyo wakati firewall inapoanza kufanya kazi, muunganisho wako unakatwa na huwezi kurudi ndani. Jiepushe na hali hii kwa kuruhusu SSH kila wakati kabla ya kuwasha UFW. Hiyo ndiyo mbinu kuu, na hatua za chini zinafanya hivyo kwa mpangilio salama.

Ikitokea kwako, hauko mbali: console ya wavuti ya mtoa huduma wako, kupitia VNC au serial, haitumii SSH, hivyo unaweza kuingia huko na kuendesha ufw disable au kuongeza kanuni inayokosekana.

Hatua ya 1: Sanidi sera za msingi

Anza kwa kuambia UFW kukataa kila kitu kinachoingia na kuruhusu kila kitu kinachotoka:

sudo ufw default deny incoming
sudo ufw default allow outgoing

deny incoming ni sehemu muhimu. Inamaanisha port yoyote ambayo haina sheria ya kuruhusu imefungwa kwa nje, hata kama huduma inasikiliza kwenye port hiyo. allow outgoing inaruhusu seva yako kuunganishwa na mtandao kwa ajili ya sasisho na mambo kama hayo. Amri hizi mbili zinabadilisha sera pekee; hakuna kinachotekelezwa mpaka uwashe UFW katika hatua ya 3.

Hatua ya 2: Ruhusu bandari (ports) unazohitaji tu

Kabla ya kuwasha, fungua SSH ili uendelee kuwa na muunganisho:

sudo ufw allow 22/tcp

UFW inaweza pia kuweka kikomo cha kasi (rate-limit) kwa SSH: sudo ufw limit 22/tcp huruhusu bandari hiyo lakini huzuia anwani yoyote inayofanya miunganisho sita au zaidi ndani ya sekunde 30. Hii huzuia skripti za brute-force bila kuhitaji programu nyingine.

Ikiwa unatumia web server, ruhusu HTTP na HTTPS pia:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Ruhusu tu kile unachotoa kwa umma. Database kama Postgres kwenye port 5432 haipaswi kupewa sheria ya kuruhusu (allow rule) mara nyingi. Badala yake, iunganishe (bind) kwenye 127.0.0.1 ili iweze kufikiwa kwenye mashine hiyo pekee. Kila bandari unayofungua ni mlango ambao unapaswa kuulinda, hivyo fanya orodha iwe fupi.

Unaweza pia kuunda mfululizo kamili wa amri za ufw kwa ajili ya server yako hapa, kisha uzitekeleze kwa mpangilio:

Hatua ya 3: Washa, na uthibitishe kuwa imewashwa

sudo ufw enable

Inatoa onyo kwamba amri hii inaweza kukatisha miunganisho ya SSH iliyopo. Kwa sababu uliiruhusu 22/tcp katika hatua ya 2, kikao chako kitaendelea. Thitibisha matokeo:

sudo ufw status verbose

Status: active
Default: deny (incoming), allow (outgoing)

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80/tcp                     ALLOW IN    Anywhere

Soma mambo mawili hapa. Status: active inamaanisha kuwa firewall inafanya kazi. Na kila sheria inaonekana mara mbili, mara moja kawaida na mara nyingine ikiwa na (v6), ambayo inakuambia kuwa UFW inashughulikia IPv6 pamoja na IPv4. Ikiwa mistari ya (v6) haipo, upande wa IPv6 haudhibitiwi, jambo ambalo ni hatari inayofunikwa katika post ya firewall ya IPv6.

Kusimamia sheria baadaye

Ili kuona sheria pamoja na namba ili uweze kufuta moja:

sudo ufw status numbered
sudo ufw delete 3

Ili kuruhusu port kutoka anwani moja tu, ambayo ni njia nzuri ya kuweka huduma ya admin kwa IP yako pekee:

sudo ufw allow from 10.0.0.24 to any port 5432 proto tcp

Firewall ni tabaka moja. Inadhibiti kile kinachoweza kufika kwenye port, lakini haipunguzi kasi ya mtu anayepiga port ambayo umeacha wazi, kama SSH. Kwa ajili hiyo, ongeza Fail2ban mbele ya SSH ili kuwabanja wanaovunja sheria mara kwa mara. Ulinzi wa tabaka nyingi (Defence in depth) unamaanisha kila tabaka linashughulikia kile ambacho kingine hakiwezi.

Firewall ina maana tu baada ya kujua nini maana ya ports na jinsi huduma zinavyosikiliza, na kuweka mipangilio yake ni hatua moja katika dakika 10 za kwanza kwenye VPS mpya.

FAQ

Will enabling UFW disconnect my SSH session?

Not if you allow SSH first. Run sudo ufw allow 22/tcp before sudo ufw enable, and your connection survives because the firewall now permits port 22. The danger is enabling a default-deny firewall without an SSH allow rule, which cuts you off. If that happens, log in through your provider's VNC or serial console and run ufw disable.

What ports should I open on a VPS?

Only the ones you serve to the public. SSH (22/tcp) so you can manage the box, and HTTP and HTTPS (80/tcp, 443/tcp) if you run a website. Leave everything else denied. Internal services like databases should bind to 127.0.0.1 and get no firewall rule at all, so they are never reachable from the network.

Does UFW handle IPv6?

On modern Ubuntu, yes: IPV6=yes is set in /etc/default/ufw, so each rule applies to both stacks and ufw status shows the IPv6 rules with a (v6) suffix. The ways it can still go wrong are covered in the IPv6 firewall trap.

How do I remove a UFW rule?

Run sudo ufw status numbered to list the rules with index numbers, then sudo ufw delete N where N is the number of the rule you want gone. You can also delete by specification, for example sudo ufw delete allow 80/tcp.

How do I allow a port only from one IP address?

Use a from rule instead of a plain allow. To let only your office address reach PostgreSQL, run sudo ufw allow from 10.0.0.10 to any port 5432 proto tcp. With a default-deny policy the port is closed to everyone until a rule opens it, so this from rule is the only way in: the whole internet stays blocked and only the address you name gets through. Do not also add a plain allow 5432/tcp, which would open the port to everyone. This is the safest way to expose a database or an admin panel. Confirm it with sudo ufw status verbose, which shows the source address beside the port.