Hack The Sec-Leading Resource Of Linux Tutorial: ufw

Setting Up a Port Forwarding Using Uncomplicated Firewall(UFW)The Linux kernel in Ubuntu provides a packet filtering system called netfilter, and the traditional interface for manipulating netfilter are the iptables suite of commands. iptables provide a complete firewall solution that is both highly configurable and highly flexible.<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnwJqO5t-cjYlTKJwDUOWpBE6hpcStrXARypGodCji4qUFUgtg2ocsVUHZGm_VaZJARKMRjmnlgIDhOUHWEO5wTG0-oclNxRCZpvAiHMjuATmAULsaXKwqEUTKSxNrB7g385tyZmzbc_ZT/s577/firewall_www.hackthesec.co.in.jpg" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="359" data-original-width="577" height="199" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnwJqO5t-cjYlTKJwDUOWpBE6hpcStrXARypGodCji4qUFUgtg2ocsVUHZGm_VaZJARKMRjmnlgIDhOUHWEO5wTG0-oclNxRCZpvAiHMjuATmAULsaXKwqEUTKSxNrB7g385tyZmzbc_ZT/s320/firewall_www.hackthesec.co.in.jpg" width="320" /></a></div> Becoming proficient in iptables takes time, and getting started with netfilter firewalling using only iptables can be a daunting task. As a result, many frontends for iptables have been created over the years, each trying to achieve a different result and targeting a different audience.The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls. ufw provides a framework for managing netfilter, as well as a command-line interface for manipulating the firewall. ufw aims to provide an easy to use interface for people unfamiliar with firewall concepts, while at the same time simplifies complicated iptables commands to help an administrator who knows what he or she is doing. ufw is an upstream for other distributions and graphical frontends.Setting Up a Port ForwardWe are going to forward incoming traffic on the port 8000 to 8081Enabling UFW: If not already enabled, start by enabling UFW. Run the following command in the terminal:<pre class="language-markup" style="background: rgb(39, 40, 34); border-radius: 0.3em; box-sizing: border-box; color: #f8f8f2; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 15.36px; hyphens: none; line-height: 1.2; margin-bottom: 20px; margin-top: 0px; max-width: 100%; overflow: auto; padding: 10px; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal;"><code class="language-markup" style="box-sizing: border-box; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 14.7456px; hyphens: none; line-height: 1.2; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal; word-spacing: normal;">[<a class="token email-link" href="https://www.hackthesec.co.in/2023/02/root@hackthesec" style="background-color: transparent; box-sizing: border-box; color: #007abe; text-decoration-line: none;">root@hackthesec</a> ~]# sudo ufw enable</code></pre>Open the UFW configuration file: To set up port forwarding, you must edit the UFW configuration file, located at /etc/default/ufw.    We mostly proffered Nano editor  <pre class="language-markup" style="background: rgb(39, 40, 34); border-radius: 0.3em; box-sizing: border-box; color: #f8f8f2; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 15.36px; hyphens: none; line-height: 1.2; margin-bottom: 20px; margin-top: 0px; max-width: 100%; overflow: auto; padding: 10px; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal;"><code class="language-markup" style="box-sizing: border-box; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 14.7456px; hyphens: none; line-height: 1.2; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal; word-spacing: normal;">[<a class="token email-link" href="https://www.hackthesec.co.in/2023/02/root@hackthesec" style="background-color: transparent; box-sizing: border-box; color: #007abe; text-decoration-line: none;">root@hackthesec</a> ~]# sudo nano /etc/default/ufw</code></pre>Enable packet forwarding: In the UFW configuration file, find the line that says DEFAULT_FORWARD_POLICY="DROP" Change DROP to ACCEPT so it looks like this: DEFAULT_FORWARD_POLICY="ACCEPT" This change allows UFW to forward packets, which is necessary for port forwarding.<pre class="language-markup" style="background: rgb(39, 40, 34); border-radius: 0.3em; box-sizing: border-box; color: #f8f8f2; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 15.36px; hyphens: none; line-height: 1.2; margin-bottom: 20px; margin-top: 0px; max-width: 100%; overflow: auto; padding: 10px; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal;"><code class="language-markup" style="box-sizing: border-box; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 14.7456px; hyphens: none; line-height: 1.2; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal; word-spacing: normal;">[<a class="token email-link" href="https://www.hackthesec.co.in/2023/02/root@hackthesec" style="background-color: transparent; box-sizing: border-box; color: #007abe; text-decoration-line: none;">root@hackthesec</a> ~]# DEFAULT_FORWARD_POLICY="ACCEPT"</code></pre>Press Ctrl+O to save the changes, then Ctrl+X to exit nano.Modify UFW’s before rules: UFW uses a set of "before rules" that are executed before the standard rules. These before rules can be used to set up port forwarding. <pre class="language-markup" style="background: rgb(39, 40, 34); border-radius: 0.3em; box-sizing: border-box; color: #f8f8f2; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 15.36px; hyphens: none; line-height: 1.2; margin-bottom: 20px; margin-top: 0px; max-width: 100%; overflow: auto; padding: 10px; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal;"><code class="language-markup" style="box-sizing: border-box; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 14.7456px; hyphens: none; line-height: 1.2; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal; word-spacing: normal;">[<a class="token email-link" href="https://www.hackthesec.co.in/2023/02/root@hackthesec" style="background-color: transparent; box-sizing: border-box; color: #007abe; text-decoration-line: none;">root@hackthesec</a> ~]# sudo nano /etc/ufw/before.rules </code></pre>Add the following lines at the end of the file, replacing <your-ip> with the IP address of the machine where the packets will be forwarded:<pre class="language-markup" style="background: rgb(39, 40, 34); border-radius: 0.3em; box-sizing: border-box; direction: ltr; hyphens: none; line-height: 1.2; margin-bottom: 20px; margin-top: 0px; max-width: 100%; overflow: auto; padding: 10px; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal;"># NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
 
# Forward traffic from port 8000 to port 8081.
-A PREROUTING -p tcp --dport 8000 -j DNAT --to-destination <your-ip>:8081
 
# Don’t masquerade local traffic.
-A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
 
COMMIT</pre>Press Ctrl+O to save the changes, then Ctrl+X to exit nano.Restart UFW: Finally, for the changes to take effects<pre class="language-markup" style="background: rgb(39, 40, 34); border-radius: 0.3em; box-sizing: border-box; color: #f8f8f2; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 15.36px; hyphens: none; line-height: 1.2; margin-bottom: 20px; margin-top: 0px; max-width: 100%; overflow: auto; padding: 10px; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal;"><code class="language-markup" style="box-sizing: border-box; direction: ltr; font-family: Consolas, Monaco, "Andale Mono", monospace; font-size: 14.7456px; hyphens: none; line-height: 1.2; tab-size: 4; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; word-break: normal; word-spacing: normal;">[<a class="token email-link" href="https://www.hackthesec.co.in/2023/02/root@hackthesec" style="background-color: transparent; box-sizing: border-box; color: #007abe; text-decoration-line: none;">root@hackthesec</a> ~]# sudo ufw disable 
[<a class="token email-link" href="https://www.hackthesec.co.in/2023/02/root@hackthesec" style="background-color: transparent; box-sizing: border-box; color: #007abe; text-decoration-line: none; word-spacing: normal;">root@hackthesec</a> ~]# sudo ufw enable </code></pre> @hackthesecurity