Packet filter with Univention Firewall

7.10.3. Packet filter with Univention Firewall#

Univention Corporate Server (UCS) includes Univention Firewall, which integrates iptables with Univention Configuration Registry (UCR).

You can use Univention Firewall to control incoming network traffic by protocol, port, and action. During installation, UCS rejects incoming network traffic by default.

By default, UCS blocks incoming ports. UCS packages can provide rules that open the ports that they require. You primarily configure firewall rules through UCR variables.

For information about packet filter rules, see Network packet filter in Univention Developer Reference [6].

In addition, the /etc/security/packetfilter.d/ directory contains scripts with firewall rules. The 50_local.sh script runs after the UCR-defined standard rules. The run-parts command runs executable scripts in lexicographic filename order. Use a two-digit prefix as a convention to express the needed order. The complete filename determines the order.

For information about configuring UCR-based firewall rules for IPv4 and IPv6, see Network packet filter in Univention Developer Reference [6].

Warning

Firewall changes can interrupt remote access to the system. Make sure that you have a fallback access method before you restart the univention-firewall service.

After you change the packet filter settings, restart the univention-firewall service. Test the affected TCP and UDP ports from a suitable host.

Warning

Deactivating Univention Firewall reduces the protection of the system. Make sure that you understand the effect on the system’s network access before you change the setting.

To deactivate Univention Firewall, set the UCR variable security/packetfilter/disabled to true.

To remove existing firewall rules, run the command in Listing 7.31. Verify the resulting network access from a suitable host.

Listing 7.31 Remove existing firewall rules#
$ service univention-firewall flush

See also

netfilter/iptables documentation

provides an overview of the available iptables documentation.

Iptables Tutorial

provides a tutorial about iptables by Oscar Andreasson.

iptables(8) manpage

provides information about configuring firewall rules with iptables.

Packet Filtering HOWTO

explains packet filtering with iptables.