Welcome back.

So in today's video, I'm going to show you how to use U F W in order to try to help secure your Atlantic server so you have W stands for uncomplicated firewall on.

So this is the firewall software that is built in a standard to Ruben to now, and you can also install it on other distributions of Lennox if you like.

As with all things in the Lenox world, there are a hell of a lot of firewall options out there.

I'm going to show you you have W because it's quote unquote, uncomplicated is relatively easy to use.

It's built into a bun, too.

You can run it on most distributions of Lennox, and therefore it's a good default standard to show you how to use.

But again, there's other firewalls off we're out there.

That may be better for whatever application that you're trying to accomplish.

Now, when you're talking about firewall software again in the security world, it's important to understand is that different types of software do different types of things in order to provide security for your server.

So anti virus software that looks for things like viruses it's important.

Understand all that firewall software does, is it simply allows or denies access to particular networking ports on your server?

Eso.

Different networking protocols require different ports.

Eso HTTP requires port 80 FTP Republican requires port 21 or possibly 20.

Sshh requires Port 22.

So, basically, by allowing or denying access to those particular ports, you either allow or deny access from the outside world to your system.

On those ports.

Doing blanket blocks generally isn't the greatest policy in the world.

Like doing a blanket block of sssh.

Doing a blanket block of ah of Port 22 may not really making a lot of sense in the security.

The world of security, basically, with the ideas.

If you're going to do a blanket block of a service, well, then why not simply remove that service from your server?

If you're going to a blanket block of sssh for everybody in the entire world coming over through the network, then the question is, Well, why don't you just disable that s s a service or simply uninstalled the SS service where the firewall really becomes powerful is because you can go in and you can specify things such as certain I P addresses are able to have access to serve imports or even certain entire sub nets can have access to certain ports.

So let's say you need to use sshh in order to remotely and minister your server.

Now you don't want to do a blanket block of sshh because if you have to remotely administer your server and you block all I P addresses from being able to remote remotely administer your server, that means you'll de facto not be able to connect it, sir.

So that's not good.

But you don't necessarily want S H to be open to the entire world because the people in China, Norway and who's Becca Stan will try to be trying to hack into your system.

So one of things that you can deal with U of W.

Is you can say I want my specific I P address to be able to access SS eight on the server, but literally nobody else.

So this may be valuable, especially in a business environment suit.

Let's say you have a server room.

You know, a few Lennox Potts is running that server room and you want to be able to sshh end to those legs boxes again just to do basic administration.

Take a look at basic log files.

Well, what you can dio is you can allow access for your specific I p address to use s s sake to those Lennox boxes.

So that allows you to be a bit remotely administer those systems even within the within the building.

But again, people from the outside world or other I p addresses in the building that literally will not be able to access the S s exports.

So these are the kinds of things you need to be thinking about when you're dealing with security and you're when you're dealing with fire walls again is the best, most appropriate way to go about security.

If you're going to blanket block a port on a server, then one of questions you should ask yourself is Then why is that service even installed on the server in the first place?

Maybe instead of worrying about the blanket block, maybe simply uninstalling that service would be the better way to go.

So what I'm going to show you how to do today is I'm going to show you how to enable you have w on a bond to again you have w comes with your bond to you so you don't even have to install it.

I'm going to show you how to look at the status of U F.

W.

I'm going to show you how to add rules too.

You have w delete rules from U F W and basically give you the over of view of how to use this in the real world.

Now one of the corpse that I'm gonna tell you again.

We talked about uncomplicated fire off again.

When you get the networking world, when you start layering technologies onto it on top of each other, uncomplicated again becomes the eye of the beholder.

Now, one of the things that I had to do in order to make the eyepiece specific rules actually work on the virtual machine that I'm showing you is I actually had to use a hardwired connection.

So again, I use ah Mac operating system.

I have virtual box installed on that Mac operating system.

And then I have you been to within a virtual machine within virtual box now something that was very interesting with us.

And again.

One of those weird quirks in the networking world is if I allowed everybody in the world toe have access to a certain port when I was on my WiFi connection.

So basically I used WiFi, and I simply use the brake adapter within virtual box to use WiFi.

So when I use my WiFi networking card within my Mac book Pro, um, and I allowed everybody access to certain import 22 21.

Whatever else that worked throughout my network, my Mac pro who connected the virtual machine, the Mac Book Pro could connect to the virtual machine.

Everybody could connect to the virtual machine.

The weird part Waas is that if I specified a specific I P addresses.

So I said, I only want this I P address to be able to connect to the Lenox server for this particular pork, and I was using the WiFi network hard in the Mac book Pro that literally did not work.

It failed completely.

My eye Mac Pro could not connect to it the Mac book Pro the host machine itself could not.

To the virtual machine, it did not work at all What I found.

I honestly I'm not sure why, But when I use a thunderbolt, a wired network connection and I start using that as the network card for that bridged adapter in the virtual machine, then all of us, when I typed in the specific I p address then that actually did work.

So this is just something to realize If you're using U F W on its own boxes, you have your own physical server.

You install loop onto onto that physical server and then you start playing around with U F.

W and networking.

You should have no issues at all.

I will tell you if you're doing these demonstrations.

If you're doing these labs in a virtualized environment, especially once you start dealing with the firewalls and specific rules and firewalls, you may have to do some additional troubleshooting to try to figure out what the hell is going on.

Literally took me about 30 minutes to figure out the solution for this, actually make the lab work.

And so I just realized you're using virtual box.

We're being more effusion or parallels or anything like that.

If you're using that bridge network connection literally.

What adapter you're using from your physical computer may cause you issues with how the firewall works.

So that's that's just one of those warnings is just one of the warnings again, once we start getting a little deeper in with these classes, that is simply the fact of the matter is, is your particular environment.

You may run into specific quirks, and you may have to trouble shoot those courts.

And I can't necessarily tell you what all the answers, maybe because I'm sitting here talking into again.

So anyways, with that, let's go over to the computer and we'll go with this demonstration and I'll show you how you F W works on a bun.

So here we are at my Mac book pro again, as I thought about before, I have virtual box installed.

I just want to go over to the settings for a second show.

You click here on settings for the virtual machine.

We go over to the network.

We can now see that I still have the bridge did after, So this is still the bridge did after setting that I've been using for these last few demonstrations.

But if we go down here to the name, we have a thunderbolt, eh?

Fernet versus the WiFi.

So again, for me to be able to do the demonstrations that I'm showing you today, I needed a hardwire network connection If I tried to use the WiFi and after for the Bridget adapter, it just it just failed out.

I really honestly can't tell you why.

So this might be something you have to go in trouble.

Shoot.

So if you're having issues, try to do use a wired network connection under braking adapter and see if that works for you, eh?

So with that, let's go over to the U Bahn to serving.

Running about to 18.4 point three.

Lt s of basically any amount to that you use.

This should work for you.

It's worked for about 10 years and should work for 10 more again.

If you're using Scent OS or another Lennox distribution, you can literally just you can install you f w and then everything else that I show you should work.

Let me log in.

We're gonna go to Bob.

And 123456 on.

We're going to hit, Enter and we're here.

So let me clear the screen.

And there we go.

So here we are at the standard command line.

Now, one of things that I want to do is I just want to bring up files illa here.

So just to kind of show you from from a networking standpoint to show you how this works.

Eso Currently I can put in 10 014 That is the I.

P.

Address of the soup on the server.

I can put in the name Bob.

I put in a password.

123456 And so this is the whole FTP set up.

But I did a different demonstration.

I can You quick connect is gonna ask me.

It's not secure.

I'm just going to say OK, this is a lab environment.

Okay, so now we can see that I was able to connect to the to the FTP server.

No big deal, No problem.

So there is no firewall at this point.

I can connect s.

So then what we're gonna do now is we're gonna do sudo so super user do and then I just want to check the status of U F W so used put in U F W.

And then we can ask what the status of U F.

W is put in the password on 23456 And we can see that the status for U.

F.

W is currently inactive.

So right at this point, I have no firewall running.

So sssh works perfectly.

FTP worst perfect play.

Any other network service that I would put on the suit bone to box would function.

I wouldn't have to do any further configurations, but we're worried about security here, so let's actually enable you f w So what we're gonna do is gonna do super User D'oh!

Do you have a W?

And then it's simply a again.

We do not have to install you f w at all.

It's already built in Thio to 18.4.

Then we're gonna hit enter.

And so now firewall is active and enabled on the system.

If we go back here and if you're quick connect again, we can see is trying to connect up here and basically it is now failing out because you f W is now running Ugo and use a different user name.

What's a Tim?

123456 way Quick Connect is now trying to connect, and it is failing.

It is unable to connect because U F W is now running.

So that's one of the first things to remember whenever you enable you have w is you have w by default denies all incoming connections.

So if we use the command so weaken d'oh dio su do you f w And then we could do something called status and then verbose.

So when we're dealing with status and u F W, there's a couple of different statuses questions.

Basically, you can ask commands so we simply just plug in.

Status itself is going to tell you whether it's active or inactive.

We do status verbose.

What that's going to do is is going to give us a bunch more information about what's going on with the status of you have done.

So we're going to click on this, and so we're going to see Okay, so the status is active.

Logging is on just low, so it does do some long.

We're not gonna worry about that today.

Uh, default.

So the default when you turn on a u f w is deny all incoming.

So this is very inboard right of you.

If you have a web server and you enable you have w know what, he's going to be able to get to that web server until you start allowing poor 80 to actually have access to the web site.

So this is one of the ways that you can screw yourself up Really bad is you decide to secure your Lennox box, you enable you have W.

And then basically all networking service is, unless you've actually allowed them, will no longer works.

If you have S S h and ftp an SMTP and http, all those networking protocols you have to go in and you actually have to specifically allow those so that people can have access from the outside world.

So just remember that by default, all incoming connections will be blocked.

All outgoing connection.

So this is updates getting to the Internet.

That's everything.

So anything going out will work.

Then there's ah routed so you can actually route I p traffic through your Lennox box you can actually use your Lennox boxes a router that is disabled by default.

And that is not something that we're going to be worried about.

Today s So basically we're sitting here, we can say, OK, so all incoming connections are denied, so that's not really gonna work for us.

So we just want to allow.

So let's say I want to be alone.