Some of the newer features of UFW haven't arrived with the version you are
using. And although the GUI version of UFW is nice the command-line version
is much more advanced.
In the following quick tutorial I will try to give
you some guidance to get a simple setup (hopefully) working. This is only
for general guidance. Adjust addresses, port numbers and protocols as
needed. E.g. If your router is on a different IP-address then adjust the
rule to fit to your needs. Also if you want to connect to a different
VPN-server use the IP-address of the server you wish to use. The IP numbers
used here are only as an example.
Keep in mind that rule ordering is
important and the first match wins! The rule which is entered first will end
up higher in the list. At the end I will explain more about this (see point
.
1. Open an terminal window and enter the following commands and adjust them
to your needs.
Use su to log in as root if you haven't or place sudo before every command.
the $ represents the prompt in the terminal.
2. Enable UFW.
$ ufw enable
This will enable the firewall and now you can add rules.
3. Set the default behavior to deny all incoming and out going traffic.
$ ufw default deny out
$ ufw default deny in
Now all in- and outgoing traffic will be blocked.
4. Add a rule to allow traffic to your router (only if this is needed).
$ ufw allow out to 192.168.178.0/24
This will allow traffic to the router/internal network which in this
case is located on 192.168.178.0/24. If your computer has multiple
network interfaces you can add the interface which you want to use. E.g.
$ ufw allow out on eth0 to 192.168.178.0/24
This will allow only connections to the internal network/router on eth0.
If eth0 is not connected and you use for example the wlan0 connection
UFW will block the traffic and you will not be able to connect to the
router/internal network, because only traffic from eth0 is allowed to
connect to 192.168.178.0/24.
5. Add a rule to allow traffic to 46.19.137.114 on port 443 with UDP
traffic. This is the AirVPN_CH-Virginis_UDP-443 server.
$ ufw allow out to 46.19.137.144 port 443 proto udp
This will allow UDP traffic on port 443 to the Virginis server
(=46.19.137.144). This is needed to connect to the VPN-server. You can
add more than one VPN-server by repeating the above rule and adjust the
IP-address to the server which you want to add. It is also possible to
specify different port numbers. Just change the port number to the port
number which is needed to connect to the VPN server. If the proto udp
part is omitted then tcp and udp traffic is allowed and if it's changed
to proto tcp then only tcp traffic is allowed.
6. Add a rule to allow in- and outgoing traffic over tun0. This is the
traffic from and to the VPN-server.
$ ufw allow out on tun0
Now it's possible for an application like the browser to connect to
different sites on the web. All the traffic will go through the vpn
server.
7. In the case that you use a bit-torrent client, you will also need to
allow incoming traffic from the port which is specified by you in the
bittorrent client (this is the port which is needed to allow peers/seeders
to connect to the bit-torrent client (NAT).
$ ufw allow in on tun0 from any to any port 54321
This will enable incoming traffic which is coming from different
IP-addresses (the peers/seeders which want to connect to your client) to
connect through the VPN-server connection (which is tun0 here). In this case
port number 54321 is used, adjust it the correct port number!
8. If you now enter.
$ ufw status verbose
You will get a numbered list which something like:
Status: active
Logging: off
Default: deny (incoming), deny (outgoing)
New profiles: skip
To Action From
-- ------ ----
54321 on tun0 ALLOW IN Anywhere
192.168.178.0/24 ALLOW OUT Anywhere
46.19.137.114 443 ALLOW OUT Anywhere
Anywhere ALLOW OUT Anywhere on tun0
This shows you which rules are applied and what the status of the
firewall is. When you enter:
$ ufw status numbered
You will get a numbered list. It will look something like this:
Status: active
To Action From
-- ------ ----
[ 1] 192.168.178.0/24 ALLOW OUT Anywhere (out)
[ 2] 46.19.137.114 443 ALLOW OUT Anywhere (out)
[ 3] Anywhere ALLOW OUT Anywhere on tun0 (out)
[ 4] 54321 on tun0 ALLOW IN Anywhere
This is a numbered list. It is important to know that the order of the
rules is important. If you allow something with rule number 1 which
allows for example all incoming and outgoing traffic, all the other
rules which are specified after that will have no effect!
And as a final notice I will also point to the possibility to delete and
insert rules. If you enter:
$ ufw delete 1 # and confirm of course
Rule number 1 will be deleted and all the other rules which followed
rule 1 will shift up in this example the list will look something like
this (after $ ufw status numbered):
Status: active
To Action From
-- ------ ----
[ 1] 46.19.137.114 443 ALLOW OUT Anywhere (out)
[ 2] Anywhere ALLOW OUT Anywhere on tun0 (out)
[ 3] 54321 on tun0 ALLOW IN Anywhere
And if you want to add a rule on a specific spot it is possible by using
the insert command. E.g. we want to add a second VPN-server so we can
choose a different one in the case one is down (could happen you know
:-)) or if we want options. The command would look like this;
$ ufw insert 2 allow out to 119.81.1.122 port 443 proto tcp
# this will add the SG-Sagittarii server
Now on spot number 2 there is a new rule inserted. The other rules will
shift down. We can generate a new list:
$ ufw status numbered
And the list will look like:
Status: active
To Action From
-- ------ ----
[ 1] 46.19.137.114 443 ALLOW OUT Anywhere (out)
[ 2] 119.81.1.122 443/tcp ALLOW OUT Anywhere (out)
[ 3] Anywhere ALLOW OUT Anywhere on tun0 (out)
[ 4] 54321 on tun0 ALLOW IN Anywhere
This concludes the tutorial. Use it to you benefit and I hope some things
get a little bit clearer. Make the appropriate changes for you setup and
expand on it. And again the GUI version is nice, but the command-line
version is beter, it only takes a little bit of time to get used to it.
Тема: Файервол + VPN помогите настроить (Прочитано 1833 раз)
