Firewall: Egress Filtering with ufw
Tags: ubuntu, beginners, linux, security
Published: 2022-02-12 08:45:15

###What is about Firewalls with Egress filtering?

Egress filtering is when we control the traffic leaving our network. Egress filtering limits our outbound traffic flow to a reduced subset by introducing Firewall rules.

###Which tool we are going to use for implementing Egress Filtering?

We are going to use the `ufw` tool which defaults in Ubuntu distros. You can also install `ufw` for other Linux distros.

Lets go root first
```
sudo su
```
We are assuming here that we have a system with Ubuntu,
lets start by enabling `ufw`
```
ufw enable
```
###Why is there a need for Egress Filtering?

Egress filtering restricts the information that you don't want to leak into internet. Whether an internal system is compromised and it shares information to some remote hosts that can we avoided, an information leak may happen due to misconfigurations or network mapping attempts and that can also we avoided.

Now we are going to block some TCP/UDP ports and IP from establishing outbound connections

###Trivial File Transfer Protocol - TFTP - UDP - 69

TFTP helps to move files between remote hosts, thus it will be a doorway for the attacker to move their payloads to the compromised system, an unsual connection between your system and a remote host through tftp is an indication of a compromised system

You can find if any connection established through this port by using the following command

```  
netstat -anu | grep ":69" 
```

 its better to block its port so that it wont do any outbound communications.

for that try the following command
```
ufw deny out 69/udp
```   
Now your firewall is updated with blocking the TFTP on UDP at port 69

###Syslog - UDP - 514

Syslog operating on UDP at port 514 helps to send logs to a server. Log files may contain sensitive or private information, anytime if you are not sure of any system, you can block syslog from making any oubound connection.

Try,
``` 
ufw deny out 514/udp
```
###Simple Network Management Protocol – SNMP - UDP - 161-162

SNMP on UDP at port range 161 to 162 is capable of collecting,organizing informations, monitor the network, detect network faults, and sometimes even used to configure remote devices.

To block SNMP, Try
```
ufw deny out 161:162/udp
```
###SMTP mail server TCP - 25

Many systems are compromised for to be used as SPAM relays for sending emails. To avoid this we can block all the IPs from accessing TCP port 25 execpt our mail server ip

```
ufw allow from <our-mail-server-ip> to any proto tcp port 25
```
```
ufw deny from any to any proto tcp port 25
```

###Internet Relay Chat – IRC - TCP 6660-6669

IRC is a network for text-based messaging. An attacker can communicate with the compromised system throuh IRC, eventhough IRC can connect with any port, the most common port ranges are 6660 to 6669.

Try,

```
ufw deny out 6660:6669/tcp
```
###The Internet Control Message Protocol - ICMP 

ICMP is a network layer protocol used by network devices to diagnose network communication issues. ICMP is mainly used to determine whether or not data is reaching its intended destination in a timely manner.

Using ICMP can lead to three differnt scenarios of vulnerablity

1. Echo reply packets (type 0 code 0) are returned by a system in response to receiving Echo Request packets. This is when someone pings our system replies back. An attacker can use this for secret communication channel.

2. An attacker can ping a network with its connected hosts and look for host unreachable (type 3 code 1) reply from the network to identify which hosts are offline and which are online which in turn becomes a network mapping tool for the attacker.

3. Time Exceeded in Transit (type 11 code 0) Network mapping tools like traceroute, tracert, Firewalk and tcptraceroute map all of the routers between a source and a target host by creating modified packets with having abnormal low Time To Live (TTL). So the routing devices in its path return ICMP time exceeded.

As usual got root with,
```
sudo su
```
Lets take a back up of our firewall rules
```
cp /etc/ufw/before.rules /etc/ufw/before.rules_backup
```
```
vi /etc/ufw/before.rules
```

which will output as below
```
# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
```
try changing like below

```
# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j DROP
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j DROP
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j DROP
```

then reload the firewall

```
ufw reload
```


Hope you guys find usefull

#Support us by [Buying us some Cookies](https://www.buymeacoffee.com/dogealgo)