Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu 9.10 server with KVM virtualization installed on it (I'll call it HOST). It has three VMs running, one with Apache installed (calling it APACHE), one with Mysql installed (calling it MYSQL), and one with Jetty running on port 8080 (JETTY). The host has a bridge configured to provide access to the VMs.

I'd like to run a firewall on the host, but not on each VM. The firewall should block all ports on the host and VMs that aren't necessary. Here's specifically how I'd like to configure it:

  • HOST should only be able to be connected to via SSH from within it's netblock.
  • HOST should not have any other ports than SSH open.
  • APAHCE, MYSQL should be able to be connected to via SSH from anywhere.
  • MYSQL should be able to be connected to via port 3306 from within the netblock only.
  • JETTY should be able to be connected to via port 8080 (it is running as a user, so can't run on 80), but traffic to port 80 should be forwarded to 8080 in the firewall as well, so it can appear as a regular http server.

I just recently switched to Ubuntu, so I'm not sure what the best firewall tool is. I've dabbled with iptables on CentOS in the past, but iptables isn't running on my host system. I've seen reference to UWF as the firewall tool for ubuntu? It looks like UWF is installed, but not active.

Any suggestions on how to get this going? What files should I be editing? Are there any good HOWTOs on doing this that I just haven't found?

share|improve this question
up vote 1 down vote accepted

I think UFW is just a fronted for iptables. Anyway you can play with its graphical frontend.

But I strongly suggest you to learn iptables. Unbuntu official documentation:

share|improve this answer
@Redride: totally agree. In fact, I've already moved to using iptables directly and am not using UFW. – Tauren Mar 11 '10 at 8:26

For what you describe I don't think you need a firewall (i.e. packet filter) setup. Simply make sure that all unneeded services are disabled or listen only on localhost/ and that the necessary services (SSH, MySQL's TCP socket) listen only on specific interfaces or subnets.

For SSH that's the ListenAddress directive in /etc/ssh/sshd_config and for MySQL it is bind-address in /etc/mysql/my.cnf. On Linux systems there is also the possibility to use /etc/hosts.allow and /etc/hosts.deny for added security.

Don't rely on a packet filter to provide all the security you need. Much more important is that you know exactly which services are running and where they are listening. You can't just slap a firewall in front of a badly setup and secured host and hope to be done with it. It is very bad practice.

share|improve this answer
@daff: thanks. indeed, I'm only running just the necessary services on my VMs. I've just updated my question, because one of the main reasons I need this is to port forward 80 to 8080 on the VM. – Tauren Mar 11 '10 at 8:21

sounds like a perfect szenario for shorewall. shorewall is a zone-based firewall-tool for iptables/netfilter and very easy to set up

share|improve this answer

Here's what you are looking for..

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.