Enabling A Firewall Is Easy In Linux

I am going to show you how to install and enable the Uncomplicated Firewall (ufw) and how to add and delete rules for it. Ufw is a very easy-to-use command line utility, and for those that want a graphical tool, gufw is available as well.
REFERENCED:
► wiki.archlinux.org/index.php/...
WANT TO SUPPORT THE CHANNEL?
💰 Patreon: / distrotube
💳 Paypal: www.paypal.com/cgi-bin/webscr...
🛍️ Amazon: amzn.to/2RotFFi
👕 Teespring: teespring.com/stores/distrotube
SOCIAL PLATFORMS:
🗨️ Mastodon: mastodon.technology/@distrotube
💬 IRC: irc://freenode #distrotube
👫 Reddit: / distrotube
📽️ LBRY: lbry.tv/$/invite/@DistroTube:2
DT ON THE WEB:
🕸️ Website: distrotube.com/
🐿️ Gopherhole: gopher://distro.tube
📁 GitLab: gitlab.com/dwt1
🔊 Audio Podcasts: www.buzzsprout.com/1263722
FREE AND OPEN SOURCE SOFTWARE THAT I USE:
🌐 Brave Browser - brave.com/dis872
📽️ Open Broadcaster Software: obsproject.com/
🎬 Kdenlive: kdenlive.org
🎨 GIMP: www.gimp.org/
🎵 Audacity: www.audacityteam.org/
💻 VirtualBox: www.virtualbox.org/
🗒️ Doom Emacs: github.com/hlissner/doom-emacs
Your support is very much appreciated. Thanks, guys!

[@j4g094]

Since you mentioned a server ... I would advise against enabling the firewall before setting up a ssh rule :D

[@dougbeney6399]

That's what's nice about newb-friendly UFW. It gives you a warning before you enable when enabling it via an SSH session.

[@j4g094]

@@dougbeney6399 huh, did not know that, thx m8

[@Reliktish]

it literally happened to me mere minutes ago fortunatly my server is next to me on the table

[@engageintellect]

Seriously tho

[@bLd321]

It's super cool that such utility as UFW exists. I remember I was also confused by IPTables. I know that basic configuration is not that complicated, but UFW syntax makes it more human friendly.

[@idjdbrvvskambvvv9007]

came here in 2023 and indeed a toggle if so human friendly

[@s.v.4880]

The fact that Distrotube uses Kerberos for authentication on his personal production machine shows how much concerned he is for security as far as authentication is concerned. Love and respect from India. Keep up the great work.

[@peppe540]

Thanks DT. Made me realize I indeed always had a firewall on in Windoze but not in Linux. Since I am on a shared network here installed and configured it straight away ;-)

[@SO-dl2pv]

Thank you very much. I hope this video is was made in repsonse to my request in a previous video. Thank you DT.

[@temudjin1155]

I've install ufw and configured it for gtk-transmission. It works very well. As the app is using different ports (you never know which ones), adding the app being treated by ufw lets you downloading without having to shutdown ufw.

[@abaneyone]

Thank you. I installed gufw on my pop os system.

[@HewaSaleem]

Another Video about your current Shell prompt and Color scheme please.

[@ChrisHiltonSr]

Nice! Thx DT.

[@shubhamdwivedi7766]

Routers have inbuilt firewall I have hardened BSD in past only thing I can say if you don't haven't router like a lan cable then it's worth it Else you are good to go unless you own a web server or servers but nice video it's good for educating new comers about features with firewall✌️

[@webcaptcha]

Would like to see episod#2 when you explain how that ufw rules turn into iptables rules. Especially with example of "limit" action.

[@MrAvalanches]

Hey DT, you do a lot of videos of how to customize your Arch distribution. Can you show us how to create your own ISO with installer to share our builds with others?

[@kunited9]

Great video, great channel

[@taidee]

UFW is always the first thing I install and setup on my Arch/Qtile install system.

[@justvaish9902]

Totally unrelated but can u please tell me how to access qtile widgets in the config.py to modify them on certain events. I just can't understand how to access my widgets, groups, etc in my own functions?

[@f23anone82]

@@justvaish9902 Not sure I understood you correctly, but to access keyboardlayout widget in my qtile config I use: Key(['shift'], 'space', lazy.widget['keyboardlayout'].next_keyboard()),

[@knowledge_harvester]

Good I wish I could understand this damn firewall better, so how do I put the rule to programs like firefox or brave browser or even applications with .Appimage?

[@Exalted_Example]

Being from a Cisco environment and configuring ACLs, this wasn't hard to pickup. But i would like to thank you for the video, this really helped bring things (mostly syntax) together. God i wish you could have contextual help (?) in Linux like in IOS/JUNOS.

[@andreyabramov4967]

Thank you, I should try it

[@h2o40fpv]

Great video Men thank u .

[@12sasi]

Hey DT, Big Thank you I have always disliked windows and always hoped for some OS which lets me customise everything. I used ubuntu for a brief while and switched back to windows very quickly that was my brief moment with Linux very long back My interest in Linux was renewed in past 1 year thanks to your videos. But again I distro hopped a lot and did not use them for long and switched back to windows. Now I have settled on ArchLinux and I am in love with the things it lets me do and though there is a learning curve i am learning everyday and your videos are my go to guide Thanks a lot

[@favor94]

Really, arch linux is the thing forced me to learn more about linux on the old days.

[@larrygall5831]

@@favor94 It really is the best distro to learn with, in my opinion. I learned a ton of new stuff with it.

[@unknown-vq1gj]

this is one of the most useful videos on dt. it would be nice if you made a more detailed video about iptables and firewalld in future.

[@moiaccaunt]

I love UFW...especially Killswitch setings :)

[@jakke1975]

The real reason why the firewalls are disabled is because many people would ditch the OS simply because they're not networking gurus and wouldn't know how to manage a firewall from cli... even experienced computer users. Networking is just a separate field... The Linux community should invest in a good and intuitive GUI, automatic rule additions (like Windows Firewall does when you install new software, with confirmation of course) and just make it simple to use. And I know there are others, like iptables with webmin or firewalld and such, but it's pretty clear that there's a huge hole in Linux when it comes to networking, security and user friendliness. It's improving but we're still a long way off.

[@Badolasantosh]

Thank you

[@idjdbrvvskambvvv9007]

"I suprise most linux user doesn't care much about firewall" Say the man who always use the secure and complicated password

[@alvesadrian]

Hey DT, what kind of prompt is that O-M-Z? which theme?

[@cokom100]

Good tutorial Sir . But I still search tutorial how to make router and internet connection sharing especially in arch Linux . In other distro such ubuntu /debian base, I successfully setting and configuration it.

[@marioschroers7318]

What shell and terminal setup is this? Looking lovely!

[@hanspetervollhorst1]

Can you please make a guide on MonsterWM and/or FrankenWM ? They are tiling window managers that come without status bar, but output all required data to customise any bar to your liking

[@send2gl]

Is it that important when running behind a router? I confess I don't have it running on my Ubuntu laptop but on some Raspberry Pi machines running 24/7 I set iptables to not allow new connections to local network but allow established or related. Port 22 allowed.

[@yiannisspanos694]

Do one about nftables. Thats were things are headed.

[@judeleon8485]

Thanks DT. However, what I still don't understand is the difference between ENABLE UFW and START UFW. Also, apart from UFW which other firewall is available on Linux?

[@Mr.Finkel]

NAT table on my router is enough for me not letting the outside in. inside to out, ill take my chances.

[@TheRealOrlandoG]

💯

[@user-jr4xs7qz7k]

I remember one day i learned 'iptables' and tried it with 'iptables -P INPUT DROP' when ssh to my remote machine...

[@chigozie123]

Abandon ship!

[@otten5666]

Are you using the Fish shell nowadays?

[@NADEEMKHAN-sj5hn]

Is portmaster is the better firewall than firewalld and ufw/gufw

[@fetB]

offtopic, but how do you make the autocpmlete show preview/suggestion

[@pord]

The opensuse firewall is quite aggressive by default.

[@eeaaay]

Firewall is just a little suspicious of everything :]]

[@lordAgustin]

Thing is, this blocks connection from QEMU. I added my virtual NAT IP to before.rules, but dunno if it works

[@MostDeviantAsiedu]

Also can you suggest a document scanning app simple scan doesnt seem to work for me at all it fails to do the job the scanner at my work place connected to the network though simple scan detects it.

[@chevxphone1126]

Skanlite works pretty well for me.

[@TheQerde]

running the default deny it only deny all apps that are not in the table. I suggest to do it

[@Milosz_Ostrow]

Why run a firewall on one's desktop computer if there may already be an excellent one running in the router between one's computer and the DSL modem or cable modem?

[@reoencarcelado5904]

@Milosz-Ostrow: An extra layer of security / An extra layer of added protection.

[@HadToChangeMyName_YoutubeSucks]

What would make sense would be having a dialog walking you through setting the firewall up when you install the system if you want to do it. If you're installing a server you shouldn't need that of course, you're going to do it manually or with a script you already have built to make it easy. The real deal though is that there are many linux users lately who are just escaping windows and have no interest in what happens under the hood, and their home router is probably protecting them pretty well already. I bet a bucket of Captain Spaulding's fried chicken against your next paycheck that 90% of windows users never touch the windows firewall.

[@knowledge_harvester]

Is firewalls effective against malware/spywares? Let's say there's a malware in my linux and it's spying on my keyboard with keylogger and spying on the files etc, if I turn on the firewall the malware wont be able to operate anymore because the malware needs connection permission to send data in and out and the firewall don't allow unless I allow it.. right?

[@ahmethakankaraaslan]

This is not the case unless you block all the outgoing connections. A firewall, in a typical usage, is to limit incoming connections. In other words, it prevents a remote server from connecting you. However you still can connect to a remote server. Think about that you still can send http requests and connect websites. A spyware either can connect to its remote and send your keyboard log. It is non-trivial to stop network activity of a potential undetected malware without disabling all outgoing ports which in return prevents you from internet connection.

[@ogemmi]

Hello there, i am new to linux. I use manjro kde before but its doesn't live long enough because its always end up breaking for me. So now i am on pop os, but the pop shop is so buggy, i used it to install app because i am still not familiar with terminal. Did i need some cleaner for linux? Because pop shop often to hang or freeze when to install app, n i am end up force close it in the middle of the proses. Sorry for bad english

[@knowledge_harvester]

Try debian if you don't play any games and linux mint if you do enjoy playing games..

[@ogemmi]

@@knowledge_harvester ty mate

[@Yuriyalloween]

what shell is that

[@wakeupNeo_]

which is better UFW or Firewalld?

[@reoencarcelado5904]

@Sean-Android: That's what I'm wondering. And I *still* haven't-found a definitive answer. I've found some people say it's FirewallD. Others say it's UFW. I *still* don't know :-(

[@pskry]

Once again, the GUI frontend is more complicated and confusing than the CLI 😅

[@chigozie123]

How weird. I know I've tried using UFW GUI in the past, and it wasn't nearly as effortless as what DT showed here

[@eeyoreofborg]

I was getting errors about missing kernel modules. The problem was that I had updated the kernel without restarting, so the solution was...turn the machine off and back on again.

[@AbduleeFtw]

Honestly do you really need a firewall?? I guess most home routers already block most ports by default... I find firewalls to be only good maybe if you have a laptop and connect to public wifi's...

[@Neko-kun-dp1hq]

You may be right, I won't pretend to know everything about networking. But I prefer to be safe than sorry. If I can ensure that I have a firewall that I know is enabled and has the rules that I want, I will feel much safer than leaving the router and its manufacturer to do the job for me. We have an Xfinity router now and I can tell you it's a severe downgrade from the Netgear we used to use. The only reason we had to switch was because Zoom calls used too much internet and 1TB monthly wasn't cutting it anymore. That router has less granular control in my opinion.

[@HadToChangeMyName_YoutubeSucks]

@@Neko-kun-dp1hq -- I always run a software firewall. I do have to set up the port forwarding on the modem as well but for one thing I'm not leaving the firewall duties on someone else's firewall and for another I do have port forwarding on a number of ports and I use the firewall and other tools to let me know when there are bad actors. OP is right though, for most home users who aren't doing ssh or running public facing web servers will probably be fine relying on their router. Hackers of the brand that attack servers are less a problem at home than phishing or malware.

[@knowledge_harvester]

Wait..wait.. but isn't firewall needful and useful for spyware/malware? like if there's a malware in your linux machine spying on you, sending keyloggers in and out then if you turn on firewall they wont be able to operate anymore because firewall only gonna allow the application you select, right?

[@reoencarcelado5904]

@M.A.-Sultan: It's an extra layer of security.

[@reoencarcelado5904]

@@knowledge_harvester That's exactly right.

[@Rwedreaming999]

Sudo -n let's u login to Sudo terminal once btw

[@MostDeviantAsiedu]

Link to wallpaper please

[@Arkanosis]

www.wallpapermaiden.com/wallpaper/30956/stones-neon-lights-reflection-scenic

[@InsaneentertainmentNet]

Appreciate the video. I've enabled mine now, but I've noticed the only app via app list is CUPS on my desktop. How do I ad more? So far I haven't had any applications complain about the Firewall including qBittorent, Firefox, FileZilla.

[@reoencarcelado5904]

@THE-INSANE-SHOW: "C.U.P.S." is an acronym. It's for Printers.

[@walter_lesaulnier]

The Fedora Firewalld docs are for the command line, UGH! It is for IT professionals in an enterprise situation. It is horrible for an average home desktop novice user. A home desktop firewall should have a basic screen and an advanced screen- the basic one should have an on/off switch and an EASY way to whitelist/ un-whitelist an application.

[@karthikcj4227]

Need help !!! I am an noob at linux , and accidentally i installed Ubuntu on hdd even though i had ssd.Realising that i reinstalled by selecting ssd and clean drive option. Now both ssd and hdd has become root. And i cant format hdd. What will i doo ?? Plss help!!!

[@szilardjakab1553]

if you create a live USB with Ubuntu and go in the live environment,, then you can use GParted, to format your HDD easily. I don't really understand your problem, but I'm sure you can fix it this way.

[@karthikcj4227]

@@szilardjakab1553 Thnkuu Sir

[@karthikcj4227]

@@____-gy5mq Thanku Sir

[@Yuriyalloween]

@@karthikcj4227 if you already installed ubuntu on the ssd, open up gparted on the ssd ubuntu and reformat it from there

[@Blackcountrysteam]

Bit to deep for me however still interesting

[@tostoday]

I use the "family" firewall. It's a Snap, so fuhgeddaboudit :)

[@mrpopo8298]

ewe eff dub yuh

[@bdbunes]

192.168.0.0/24 is a private subnet so being behind the NAT a firewall isn't all that necessary on a desktop. I'm sure the "know it alls" will jump in here on this but it's simple networking. I appreciate the videos DT, don't get me wrong but your average home user won't need a firewall without a public facing DMZ beyond a home router. If one is hosting a server farm then that is a different story.

[@spinkey4842]

whats U F DUBYA

[@priit7777]

Firewalld.

[@kriscoryn5202]

what have I learned today from DT : systemd enable and start service xxx in 1 line systemctl enable xxx.service --now thanks this will save me some typing

[@larrygall5831]

Yeah, I never knew about using --now.

[@diobrando309]

Love the channel but just can’t get over how you say W. Is this like an American thing?

[@TsukiToHotaru]

I have firewall setup on my router so there's probably no need to have another one on the computer 🤔

[@Rwedreaming999]

Help me set one up?

[@TsukiToHotaru]

@@Rwedreaming999 I replaced my router's firmware with openwrt. Thus setting up a firewall is uncomplicated using openwrt's firewall3. Btw using the firewall function from web gui of stock firmwares could fit most use case.(*´∀｀)

[@reoencarcelado5904]

@'s-comment "I have firewall setup on my router so there's probably no need to have another one on the computer": An extra layer of security[_&_privacy] is always a good idea (at-least when it comes to computers and firewalls).

[@TsukiToHotaru]

@@reoencarcelado5904 Sure it is :)

[@stranded_mariner7695]

UFW is very easy to use, but you admitted yourself that most users don't even enable it because they don't know about it, wouldn't it be easier to explain GUFW for this userbase? If they don't know about a firewall, surely they will struggle with command line?

[@reoencarcelado5904]

@stranded_mariner: If they don't have any adequate accurate numerical step-by-step *detailed* instructions, yeah.

[@stranded_mariner7695]

@@reoencarcelado5904 I don't see why everything has to be command line first, GUI later, most people migrating to linux will only know GUI, therefore it would be better to explain the GUI option first

[@bahathir_]

If I am in public Wifi network. this is the simplest netfilter rules I used. # iptables -A INPUT -i lo -j ACCEPT #iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # iptables -P INPUT DROP The rules will drop all inbound packets to the host. including ping request. So, nmap or porscanner unable to scans the host's [open ports. To clear/flush the rules. # iptables - P INPUT ACCEPT # iptables -F THank you.

[@eeaaay]

The first rule of the Linux fan club is, DO NOT USE PUBLIC NETWORKS! the second rule is SEE THE FIRST RULE :]]

[@bahathir_]

@@eeaaay BTW. the rules limit the GNU Linux fans to stay connected. :) GNU Linux fans should able to be connected anywhere. anytime without being detected or suspicious.. Example: Open the terminal emulator at full screen. or just using text console. Use GNU Screen or tmux. and runs metasploit to scan the public network. and switch back to blank terminal. and play music or movie at fullscreen.. From time to time, release and change the IP address.. or even change MAC Address.. Even better,, everything can be scripted and automated in background.... .. Use this knowledge wisely and ethically. Thank you.

[@eeaaay]

@@bahathir_ Ok, you can do whatever you want with your machine, you can load any script into your machine, you can just donate your machine to a thief, this does not contradict GNU, the GNU/Linux fan club, it is like constitutional amendments that meet the challenge of the 21st century, and not the 20th century:] And when you save a file, you do not specify the type, size, location of the file)) as it was in 1970 ))

[@eeaaay]

These amendment 2 rules are about security, because there is simply NO other security on the public network and can only be used by you voluntarily, according to GNU

[@bahathir_]

Yes. and it can be summarized to... Freedom of Choice....

[@staticdominguez]

Dubya

[@ygjt76v0-----]

Linux nftables now , not ufw

[@zaidgharaybeh8422]

This seems so stupid, I have to first enable ufw, then start it from systemd, then enable it again directly? Wtf why are there 3 steps to just essentially launch an application

[@Sound_.-Safari]

You mean I shouldn’t just run everything as root? Also I’m only a few seconds into the video, hope you check out fire-jail

[@lrdrl6408]

Hmmm... download the latest ubuntu via torrent yeah sure.........

[@thenextpoetician6328]

The day I need a firewall, I'll head for the hills. I used to run UFW. Now I don't. Zero difference.

[@ShadowManceri]

You don't need brains either.

[@ShadowManceri]

@@Taklsdjw093 You don't need to feel insulted. Just run to the hills like OP.

[@ShadowManceri]

@@Taklsdjw093 First off there was nothing insulting what I said. If you got insulted then that is your personal shame, I don't care. If you got insulted for other people, then it's actually worse. Pro victimhood is a serious mental problem that needs treatment. Second note, he said he doesn't *need* firewall, not that he doesn't *want* one. Those are different things. You swapped these words. Don't try that equivocation bullshit. Third note: Do not reply. Nothing good comes out of it.

[@jordan2869]

I had only one app on the list which was CUPS. I had to manually download extra UFW applications profiles. Now I get these errors. WARN: "Invalid ports in profile 'NTP'" WARN: "Invalid ports in profile 'OSSEC'" WARN: Skipping 'README.md': couldn't process WARN: "Invalid ports in profile 'SIP'" WARN: "Invalid ports in profile 'SNMP'" WARN: Duplicate profile 'Socks', using last found WARN: Duplicate profile 'WWW', using last found WARN: Duplicate profile 'WWW Secure', using last found WARN: Duplicate profile 'WWW Cache', using last found WARN: "Invalid ports in profile 'DHCP6'" WARN: Skipping 'distcc': also in /etc/services WARN: Skipping 'spamd': also in /etc/services WARN: Skipping 'syslog': also in /etc/services WARN: Skipping 'whois': also in /etc/services WARN: Skipping 'wsdd': couldn't process

[@jordan2869]

Now sure If it was the correct way to fix but I deleted all the applications with warning and now the app list is normal.