I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way:

ufw enable
ufw allow 22/tcp 25/tcp 80/tcp 443/tcp 9000/tcp
ufw allow 53/udp
  • I wonder if I shouldn't go 1:1 by means of tcp:udp.
  • I wonder if I should distinguish incoming/outgoing for tcp/udp or both.

Is my filtering correct?


Since you're using UFW, it's a greatly simplified firewall interface compared to, say, using iptables directly. Consequently, it does some "magic" for you:

  1. Blocks all incoming traffic by default.
  2. Allows all outbound traffic by default.
  3. Allows some incoming traffic (packets that are related to or part of an established connection)

Then, the rules you create are incoming rules only, but the outbound part will be allowed because all outbound is allowed by default. So your rules are to allowing incoming traffic.

I wonder if I shouldn't go 1:1 by means of tcp:udp.

There's no reason to do that. HTTP, SMTP, HTTPS never go over UDP, so why open holes in the firewall you don't need? Of the ports you listed, DNS is the only one that might use UDP. (Note that you only need to allow 53/udp) if you're hosting DNS, not to access an upstream DNS server. (And if you're hosting DNS, you should allow 53/tcp as well.)

I wonder if I should distinguish incoming/outgoing for tcp/up or both.

As noted above, UFW does incoming rules by default, so you are distinguishing, it's just not obvious because it's part of the "uncomplicated" nature of UFW.

I assume you're running something on port 9000 that lead you to open that port, but I don't know what it would be -- it's not needed for nginx, postfix, or SSH by default.

  • Many thanks for the didactic answer. On port 9000 I run PHP-FPM (I know it uses, or used that port). Indeed I don't host DNS (I configure DNS in my host provider's DNS management tool), I just read that that port might be needed as part of DNS resolve process, but the guy who wrote that says he isn't sure and it's likely he's wronng. – Arcticooling Jan 12 '18 at 22:45
  • David, maybe you have some spare time to review my really small code here, that includes this try to harden the Ubuntu environment? codereview.stackexchange.com/questions/184972/… – Arcticooling Jan 13 '18 at 5:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.