Gufx firewall sufficiency

Forum Moderators: bakedjake

Message Too Old, No Replies

Gufx firewall sufficiency

abrodski

2:17 pm on May 28, 2015 (gmt 0)

Hello!
I'm pretty new to the world of Linux. Right now I use Ubuntu Desktop 14.04 Later down the road I plan to install LAMP to try to run a web server.
Generally speaking, I prefer GUI (as most people, I guess), though I have no problem with CLI (remember myself in 1990 with MS-DOS).
As a regular user I don't think I really need a firewall in Ubuntu. Sticking to installation defaults is fine by me. But as an admin of a web server, I would think that I'm gonna need something beyond the Desktop ed. defaults security-wise. I'm aware of IPtables, of course. But to me it seems a little bit too much to learn, too steep of a learning curve right now. Then there's ufw.
And a GUI front-end of it, which is Gufw. Here opinions vary. Some say, I must learn IPtables, others think that Gufw does its job fine.
So what I'm asking here is not just an OPINION, but also a reasoning behind it. Real life example maybe etc.
Thank you.

dstiles

7:13 pm on May 28, 2015 (gmt 0)

I have an online linux machine running Mint, which I prefer over Ubuntu - mine is Mint 13 which has Ubuntu 14 underlying it. I also use this on a few desktop/laptop machines.

I run postfix/dovecot mail server on the online machine plus Squirrel on apache as the webmail interface.

A firewall is sometimes useful - for example, to block certain services to everyone except "me". May not be absolutely necessary but safer and more controllable.

I use iptables occasionally via Terminal to deal with real nasties and awkward situations. I sometimes use gufw but some of the IP ranges I tried to add as blocks were added AFTER one allowing a wider range and I had to manage iptables directly to insert them in the correct place. So: both ok but watch for any interaction. As to learning iptables: the degree of knowledge I required was minimal and I've probably forgotten it now so will have to learn it again. :(

I run another Mint-based machine locally as a backup mail server plus a few other features (eg cherokee web server for local services). It's set up more or less the same as the online one; the firewall makes it easier to reject bad IP ranges (remember that mail servers need incoming ALLOW for mail server IPs whereas desktops do not).

abrodski

2:55 pm on May 30, 2015 (gmt 0)

Okay, thank you!