Do I need ufw reddit / selfhosted ---------------------------------------------------------------------- Otherwise_Table · 2023-10-17 19:05 I have my my home server behind my router and have port forwarding for wireguard and Plex , do I even need ufw setup ? ---------------------------------------------------------------------- nyrosis · 2023-10-17 19:09 Security operates in layers and ufw is a pretty simple layer to setup. Especially if you only have like one or two services you need exposed on a given system. ---------------------------------------------------------------------- DudeWithaTwist · 2023-10-17 19:28 You don't, the firewall is being provided by your router. Some people put computers on the DMZ which does require a user-provided firewall. ---------------------------------------------------------------------- valdecircarvalho · 2023-10-17 19:45 If you don't know, you don't need! ---------------------------------------------------------------------- fractalfocuser · 2023-10-17 20:02 Yes every host should only be exposing what it needs to be exposing. UFW is dirt simple too. The amount of protection you gain for the effort is huge ---------------------------------------------------------------------- souam666 · 2023-10-17 21:01 Don't quit your day, job. That's terrible advice. You need to put layers of protection in and out on your network. From the internet entry point to the services themselves. And that's just a bare minimum for good practices. Then you add extra security tools like authelia, failtoban, etc. Most consumer routers have very limited firewalls that don't protect much at all. ---------------------------------------------------------------------- DudeWithaTwist · 2023-10-17 21:44 Right, but we're not talking about authelia or fail2ban, we're talking about firewalls. And my advice is why would anyone run 2 firewalls. If you need 2 firewalls, then clearly one of them isn't trustworthy. If OPs router doesn't have a trustworthy firewall, then UFW isn't what they should be worried about, they should get a router with a trustworthy firewall. ---------------------------------------------------------------------- souam666 · 2023-10-17 21:51 Every layer needs its firewall and protection, Stop with your bad advice and educate yourself before misleading people. The idea is that if one of your devices gets compromised, you still have a degree of protection ---------------------------------------------------------------------- chronop · 2023-10-17 21:56 external traffic is not the only attack vector you need to worry about, you should also be protecting against internal traffic which means using things like ufw or windows firewall. layers of protection, like they said ---------------------------------------------------------------------- DudeWithaTwist · 2023-10-17 22:02 If someone gets their home router compromised, it's just over. UFW ain't gonna do much to keep your secrets safe. I trust my router to not to get hacked, and you should too. Like I said, you have bigger problems if your router isn't trustworthy. ---------------------------------------------------------------------- souam666 · 2023-10-17 22:07 It's beyond the router. People have a rough average of 20 devices on their home network these days. Let say your server gets hacked, but the compromise doesn't have root access. Then it's limited to what the firewall will let go across different interfaces and out. And to what the other devices will allow to be in. I am gonna say it again, educate yourself before giving out advices. Or just keep stacking up bad comment karma. That's really up to you. ---------------------------------------------------------------------- DudeWithaTwist · 2023-10-17 22:18 If your server is compromised, having ufw installed or not will not make any difference in your hypothetical. UFW allows all outgoing connection in the default configuration. And I haven't seen you provide this advice to OP yet. You should probably tell them to change that. I don't care about the downvotes, I'm not arguing the silent majority here man, I'm arguing you. But congratulations if the upvotes boost your ego. ---------------------------------------------------------------------- mosaic_hops · 2023-10-17 22:24 Yes, ufw protects you from devices on your local network. Remember, all it takes is a single compromised device - just a single download of a sketchy Android app for example, or a wrong click in a browser - to render your external firewall completely moot. ---------------------------------------------------------------------- souam666 · 2023-10-17 22:34 Depending on the use case, default rules aren't always the same... and the point I am making isn't to help OP but trying to stop bad advices. ---------------------------------------------------------------------- bushwald · 2023-10-17 22:46 yes ---------------------------------------------------------------------- ASCII_zero · 2023-10-17 22:56 Should I put all my jewelry in a safe at home if I have a lock on my front door? ---------------------------------------------------------------------- HejdaaNils · 2023-10-17 23:02 Ufw is really simple, you should. ---------------------------------------------------------------------- DudeWithaTwist · 2023-10-17 23:04 I still haven't heard enough justification as to why I'm wrong. UFW isn't good right out-of-the-box, you haven't seen OPs router to confirm if it's trustworthy or not, and you've provided no practices that OP should follow should they choose to use UFW. Yea very productive. Inside OPs thread about wanting advice, just tell me I'm wrong but don't provide any alternative. It's easy to tell me I'm wrong. What a helpful community you're helping foster. ---------------------------------------------------------------------- souam666 · 2023-10-17 23:11 I gave you the answer in my first reply. Multiple layer of protection. As other people also mentioned. OP's router setup is really not relevant. As if there is use of VPN, overlay network, Argo tunnels, and such will create different needs in terms of protection and configuration. The argument was never if the out-of-the-box solution worked. But trying to squash the mindset of not doing anything and not using the tools available like ufw or iptables. Your answers should have been. Of course, you use a firewall, and then you can also use other tools The back and forth should have stopped after you got called out by 2 different users that you were wrong. Let alone people just avoiding confrontation with a troll. ---------------------------------------------------------------------- DudeWithaTwist · 2023-10-17 23:12 If you keep your jewelry box in the most obvious place, what's the point? Same with installing UFW with default/little configuration. To make them effective protection mechanisms, you need to hide the jewelry box/research best UFW practices. Or as my argument states, if you're filling your house with expensive shit, buy a strong lock for your doors/windows. ---------------------------------------------------------------------- TrustyworthyAdult · 2023-10-18 00:22 No take the time to actually learn iptables and then learn how to properly integrate fail2ban with iptables. ---------------------------------------------------------------------- emprahsFury · 2023-10-18 01:04 Ah yes iptables, ole reliable; i suppose you use netstat instead of ss and ifconfig instead of ip too ---------------------------------------------------------------------- TrustyworthyAdult · 2023-10-18 01:16 If you were as clever as you think your comment is you would know that would depend on the distro. ---------------------------------------------------------------------- SchmeepyDooDoo · 2023-10-18 09:51 /frantically googles UFW So ugh, I run Unraid and port forward plex and a valheim server. Should I figure this out too? ---------------------------------------------------------------------- isThisRight-- · 2023-10-18 10:17 Yea ---------------------------------------------------------------------- souam666 · 2023-10-18 10:48 Without going on a rant. UnRAID doesn't really have a firewall, so you end up deping on a latlyer 2 firewall. And depending on your router, you may be SOL. When you port forward, you basically open the route on fron your router's firewall. At that point, you depend on if the application is secure now the attack vector is as wide as the intention of the attacker. Unraid is a pain when it's down to security anyways. ---------------------------------------------------------------------- SchmeepyDooDoo · 2023-10-18 12:28 Yehhh, Ive actually got a new router but nothing with baked in firewall. Was thinking of getting an extra nic an lesrning to run opnsense either on thr server or in a dedicated nuc. But i gotta say; network security Is one of the densest most difficult to grasp topics ive ever dealt with… ---------------------------------------------------------------------- souam666 · 2023-10-18 12:35 One of the issues with security is that there are things you can do to make yourself secure, but it's never 100% proof. You do have to keep in mind that at home, you aren't really a target beyond mass scans or one of your users trying to be a smart ass. An the end of the day, you want to minimize your attack surface and oresense on the internet beyond what you absolutely need. For hardware, it all depends on how deep you want to get. At the entry of your network, you jeed some complete solutions like a unifi product, pfsense, opnsense, etc. If you do t have access to all that hardware, you can always virtualize your homelab. So you would use a hypervisor like proxmox and only expose your management interface through your home network, and then you create a few virtual networks and virtualize pfsense or opensense. You would need to draw it out and try to have more than one NIC to separate your management and the rest, but it could be a viable option. Unless you go crazy and build a whole rack. ---------------------------------------------------------------------- SchmeepyDooDoo · 2023-10-18 12:47 Yeh im roughly familiar with some of these concepts. Its funny when you talk about a hypervisor though. Seen the word; no idea what it does. I think the key thing Im slowly working towards is exposing my calibre web to the internet through a cloudflare tunnel type getup, but its such a janky docker I need to have everything sorted before going to a website can take you to my server; i want ssh only, fail2ban, full firewall in front of everything that comes in, nothing port forwarded except nginx ports, vlans partitioning off the exposed surface, redo all passwords and logins to all be different for every single application; probably other hardening lists - the full works. So far I managed to get to letsencrypt and nginx then it all got a bit fricking scary and i realised i needed some serious learning time whre its stalled ever since heh. Acthally considering starting with an udemy course on home networking to make sure i have the verh basics of how the internet and networks acthally work first so i have some blocks to build off… ---------------------------------------------------------------------- souam666 · 2023-10-18 12:53 A hypervisor is basically what is hosting your service and help segrementing. It makes rhubg like backup a lot easier, too. There is a lot of good information out there for that. For networking fundamentals, you'll have to find a teaching method that works for you. Some free youtube stuff may be enough as well. I like channel like Lawrence systems, but he uses xcp-ng and I am not familiar with that one. But the principle applies to pretty much all. Or you could go with a HCI setup like harvester.io but that a little overkill unless you want to learn kubs ---------------------------------------------------------------------- souam666 · 2023-10-18 21:13 I mean, there are some good tools out there. Swag for reverse proxy is decent and tends to be kept updated. I used nginxproxymanager in the past, but there was a vulnerability that took months to get fixed, so I pulled away. Obviously, learning nginx proper would be a must, but that's your choice. Honestly, without paying for a course. You want to have a strong base understanding of permissions, ACLs, networking, and such. youtube could help you along as you try to apply to your own use case and nit just copy pasting a tutorial. A hypervisor is basically the host to your homelab where you run multiple VMs and virtual networks. It also makes it easier to backups whole vm ---------------------------------------------------------------------- SchmeepyDooDoo · 2023-10-18 21:48 Well, saved. Will refer back to a few things here :)