Shipways manages ufw on every server it provisions, from a server’s
Network tab. fail2ban is installed alongside it.
Everything not listed is refused.
Order matters
Rules are matched top to bottom, in the order they were added, and the first
one that matches decides. A deny sitting below an allow for the same port
never gets a say.
If you are adding a deny to carve an exception out of a broader allow, it has
to go in first. There is no way to reorder rules after the fact, so remove and
re-add.
What a rule is
Action — allow or deny.
Protocol — TCP, UDP, or both.
Port — one port, or a range written 9000:9100.
From — an address, or a block such as 203.0.113.0/24. Empty means
anywhere.
Rules are applied to the machine as soon as they are saved.
Changing a rule
Edit, from the menu at the end of a rule’s row, changes any of the five
things above. Saving applies it to the machine straight away: the new form of
the rule is added first and the old one taken away after, so the port it covers
is never closed in between.
Editing does not move a rule in the order. A rule edited keeps the place it was
added in, which is why an exception still has to be added before the broader
rule it carves out of.
What a server starts with
SSH on whatever port the server was recorded with, always. Beyond that it
depends on the type: a machine that serves HTTP gets 80 and
443, and one that does not gets neither.
If nothing in the list allows SSH, nobody will be able to reach a shell on the
machine once the firewall is written. The panel says so before you sync.The agent is unaffected either way — it reaches out over HTTPS rather than
being reached — so Shipways can still repair the machine. A human locked out
has nothing left to repair it with.For that reason the last rule allowing SSH cannot be removed, moved off the
port, turned into a deny, or narrowed to UDP. Add another way in first. It can
still be narrowed to an address or a block, which leaves a way in.
Sync
Sync rewrites the machine’s firewall from the rules recorded here, in one
pass. Use it when a machine has drifted — somebody ran ufw by hand — or when
a change did not apply because the server was unreachable at the time.
The rules recorded in Shipways are the truth. Sync makes the machine agree with
them, not the other way round.
Reaching a database privately
Opening 5432 or 3306 to the world so an application server can reach a database
server is the wrong shape. Use
server connections instead: they let
one named machine in over the private addresses, without anything being exposed
publicly.
A connection opens every port to that machine. When you want less than that,
add a rule here with the other machine’s private address as its From. 