0

I am trying to find out the difference what ubuntu firewall is doing.

First I disabled the firewall, using sudo ufw disable and run nmap scan over localhost sudo nmap 127.0.0.1. I got the result

Starting Nmap 6.40 ( http://nmap.org ) at 2016-10-09 14:48 IST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000016s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
80/tcp   open  http
631/tcp  open  ipp
3306/tcp open  mysql

After enabling firewall, I run nmap, and got same result. So what is the difference ?

  • What does sudo ufw status verbose return? – A. Darwin Oct 9 '16 at 9:41
  • Status:active Logging:on (low) Default:deny (incoming), allow (outgoing), disabled (routed) New profiles:skip – Tarun Oct 9 '16 at 9:45
1

After enabling firewall, I run nmap, and got same result. So what is the difference ?

Like you said, there is no difference. The reason is that the default configuration of UFW allows loopback traffic, i.e. traffic involving 127.0.0.1.

You can do everything with ufw that iptables can do. You can add only simple rules using the command line. If you want to add more advance rules, then you can accomplish this by editing several ufw config files.

/etc/default/ufw : This is main ufw config file for default policy and kernel modules.

/etc/ufw/before.rules : Rules in these files are calculate before any rules added via the ufw command.

/etc/ufw/after.rules : Rules in these files are calculate after any rules added via the ufw command.

By default UFW allows DHCP, ping and loopback. You can disallow this by editing the before.rules file.

sudo nano /etc/ufw/before.rules

Source

If you scanned your computer from another IP address, or if you edited the default rules, a Nmap scan would probably show nothing.

  • Just wondering, is there something like full scan in nmap, that scans for everything it can. So that I can see more differences while firewall is on and off. – Tarun Oct 9 '16 at 10:52
  • You can use nmap -p- 127.0.0.1 to scan all the 65,535 possible ports (while nmap 127.0.0.1 by default only scans 1,000 ports). However, since your firewall allows that kind of traffic, your scan will be different from the scan of an attacker (which should be blocked by UFW). If you want to understand more about firewalls and Nmap scans, I suggest you to set up a Ubuntu virtual machine, enable the firewall and launch Nmap against that IP from another machine. In this way, you can (safely and legally) simulate the result that an attacker would get. – A. Darwin Oct 9 '16 at 11:02
  • In this case it might not be necessary since you are running Nmap from the same network, but I would also add -Pn to the command of the previous comment to force Nmap to scan every port regardless. – user1156544 Dec 8 '16 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.