Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create a rule that allows anyone on eth1 to access port 80. Can UFW do this or should I go back to using Shorewall?

To clarify: this is a capabilties question, can ufw handle interfaces as a target?

share|improve this question
    
I'm specifically looking to specify the interface, not the ip or network. –  Antonius Bloch May 17 '11 at 22:54
    
This is a management workstation/cobbler/puppet server. It's got 4 interfaces connecting it to 4 different networks, 2 public networks & 1 multi-tenant network & 1 private management network. I want to make sure that the tftp,dhcp servers and other provisioning services are only available on the management network and not on the other networks. –  Antonius Bloch May 17 '11 at 22:59

2 Answers 2

up vote 17 down vote accepted

I finally read the man page:

By default, ufw will apply rules to all available interfaces. To
limit  this,  specify DIRECTION on INTERFACE, where DIRECTION is
one of in or out (interface aliases  are  not  supported).   For
example,  to  allow  all  new incoming http connections on eth0,
use:

ufw allow in on eth0 to any port 80 proto tcp

To elaborate a little the answer is yes, ufw can use the interface as a target. My particular rule looked like this:

ufw allow in on eth1 to [eth1 ip addr] port 80 proto tcp
share|improve this answer
    
I come back to this answer all the time. Thanks! –  iurisilvio Jun 10 at 13:10

Yes, if eth1 is just a normal interface with its own IP address (and that IP address is what you're trying to grant access to):

ufw allow from any to [eth1 ip addr] port 80

But if there's anything more complicated than that, then we need more info about how this system is set up.

share|improve this answer
    
See my comments above, since it's possible that the tenants can change network settings and access that ip address this might not work out well. –  Antonius Bloch May 17 '11 at 23:00
    
If they can change network settings then they have root and can change firewall rules, too, regardless of which software firewall is used. –  Shane Madden May 18 '11 at 0:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.