Recently I had to use F-Response on a untrusted network and a colleague asked me how to configure the firewall on Ubuntu on this unsecure network, so I figured I would write this up for future reference.
I normally have the firewall on my Linux box set to paranoid mode, I guess it comes with the territory, hey echosix! I normally open up the ports as and when I need them.
Ubuntu comes with a great net filter based firewall based upon iptables, which is disabled by default and is really simple to get it started, you simply type;
sudo ufw enable
When connecting my Linux box to make an acquisition using F-Response I normally use the excellent SMART tool by ASR Data. To open the firewall up so the the F-Response client can talk to the agent for the default port of 3260 , you can simply type;
sudo ufw enable (to start the firewall)
sudo ufw enable 3260 (to open port 3260)
sudo ufw status (to view the new rule we just created)
Now, this opens port 3260 to any internal or external computer so I like to try and secure this to clients on the local network. Again this is a simple command, we just need to type;
This is telling the firewall to only open port 3260 to computers with an IP address on our local subnet, in this case 192.168.1.0
To check the status of the firewall rule just created we simply type;
That's all we needed to do to allow our Linux box to be protected by the firewall and be able to access the F-Response client.
To remove the firewall rule we simply type;
ufw delete allow proto tcp from 192.168.1.0/24 to any port 3260
No comments:
Post a Comment