1

I use Ubuntu with ufw enabled. I connect to the Internet directly without a firewall. Are there any risks ?

  • Connecting without a router is always risky. But to give a clear answer we need to know that if you using private or public ip. If you are using private IP then your traffic are going through NAT which is pretty safe then using public IP – Muhammad May 28 '17 at 18:38
  • My ISP has given me a private IP configuration. – linuxyogi May 28 '17 at 18:46
  • Everything is risky, the question is, how risky. IT security is mainly about the effective estimation of the risks and costs and manage them. In my opininon, your system is okay for ordinary home PC usage for common circumstances, i.e. turning your PC off and then running to the nearest hw store would be an over-reaction. – peterh May 28 '17 at 18:49
  • I believe the word you're looking for it firewall (and I've changed your question to reflect this). A firewall blocks all but certain packets. A router simply routes packets, and may or may not block packets. When it blocks packets, it's acting as a firewall. – Steve Sether May 28 '17 at 19:12
1

Everything is risky, the question is, how risky. IT security is mainly about the effective estimation of the risks and costs and manage them.

The main fun in it is that the costs are so or so estimatable, but the risks can't. If you would know, how can your system be attacked, you could (in most cases) easily close the hole. This makes IT security more like an art.

In my opininon, your system is okay for ordinary home PC usage for common circumstances, i.e. turning your PC off and then running to the nearest hw store for a needless router would be an over-reaction.

Watch for that your firewall has a negative list (most ideal if only outgoing connections are allowed, or by default all incoming is denied, except the few what you allow). Furthermore, check that you have some DNS spoofing protection.

  • $ sudo ufw status verbose [sudo] password for mac: Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip – linuxyogi May 28 '17 at 19:02
  • I use Google dns. – linuxyogi May 28 '17 at 19:03
  • @linuxyogi I don't know the google dns, your ufw config seems okay. The worse security threats to your system what I can see: 1) browser CSS sechole 2) you download and install some binaryonly crap with a trojan. | None of them seem serious danger in your case. – peterh May 28 '17 at 19:08
  • @linuxyogi Note, it is my heuristical estimation and as I wrote, you can't really estimate the risks. Thus, it is a highly opinion thing. – peterh May 28 '17 at 19:11
  • I understand. I also keep Ubuntu up to date and that I guess is another plus point. – linuxyogi May 28 '17 at 19:13
0

UFW is indeed a firewall, and blocks inbound packets from the outside world unless you explicitly open up a hole in the firewall.

Realistically, there's little difference between a properly configured software firewall, and having a hardware firewall between you and the rest of the internet. You can equally screw up a hardware firewall as much as you can a software firewall. In addition, most home firewalls are Linux based anyway, so any security vulnerabilities in the firewall are likely to exist in both devices.

It's even possible that having a software firewall on your computer is more secure than only having a hardware firewall, since your computer firewall is more likely to be automatically updated with newer security patches than a hardware firewall, which normally doesn't do this.

The only disadvantage to this setup is you don't have any local LAN to connect other devices in your home to the internet, since your computer has a publicly rotatable IP address rather than being behind a NAT. That's generally why people have a hardware NAT/Firewall, because they want to share the internet with multiple devices on their own LAN.

0

If your ufw is correctly set, nothing should happen. When you are behind "home" router there is usually one advantage and it is NAT. Because of it your PC is not exposed to the internet directly and even if rules on router's fw are not set correctly the 1:1 nat or port forwarding usually need to be configured separately and are not in use by default. But if you will use 1:1 NAT and you will have no FW rules at all it is the same as you have PC connected directly to the internet (based on default fw policy ofc. I assume it is allow-allow)

So in summary, there is only one difference and it is NAT. If FW rules are correctly configured, you should be OK. Just check if anything inbound except established and related traffic is disabled.

  • I just checked at grc.com and I passed the test. – linuxyogi May 28 '17 at 18:47
  • U sure? :) Check your configuration rather. – Fis May 28 '17 at 18:51
  • Yes. It says "PASSED" I have also blocked ICMP by editing a file related to ufw. – linuxyogi May 28 '17 at 18:54
  • I'll probably create such scanner too :) – Fis May 28 '17 at 18:55
  • Can you please change your comment of "router" to "firewall"? A router is simply a device that routes packets. There's multiple routers between you and any arbitrary internet location. It doesn't necessarily block packets. A firewall is the word you're looking for. – Steve Sether May 28 '17 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.