使用BigBlueButton示例在Ubuntu Server 16.04上配置UFW

UFW （简单防火墙）是一个iptables界面，旨在简化防火墙的配置过程。 iptables工具可靠且灵活，但是新手自己配置它并不容易。 我只是这个行业的新手。

默认情况下，iptables中启用了ACCEPT策略，它看起来像这样：



在我们的示例中，没有任何限制。 默认策略为ACCEPT。

输入-输入连接。
输出-外出化合物。
转发-路由（例如，有必要将路由写入网关后面的计算机）。

您可以使用命令sudo ufw enable
并且在此命令之后，iptables策略立即更改。
ufw打开后，这是BigBlueButton上的样子：

 Chain INPUT (policy DROP) target prot opt source destination ufw-before-logging-input all -- anywhere anywhere ufw-before-input all -- anywhere anywhere ufw-after-input all -- anywhere anywhere ufw-after-logging-input all -- anywhere anywhere ufw-reject-input all -- anywhere anywhere ufw-track-input all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination ufw-before-logging-forward all -- anywhere anywhere ufw-before-forward all -- anywhere anywhere ufw-after-forward all -- anywhere anywhere ufw-after-logging-forward all -- anywhere anywhere ufw-reject-forward all -- anywhere anywhere ufw-track-forward all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ufw-before-logging-output all -- anywhere anywhere ufw-before-output all -- anywhere anywhere ufw-after-output all -- anywhere anywhere ufw-after-logging-output all -- anywhere anywhere ufw-reject-output all -- anywhere anywhere ufw-track-output all -- anywhere anywhere Chain ufw-after-forward (1 references) target prot opt source destination Chain ufw-after-input (1 references) target prot opt source destination ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST Chain ufw-after-logging-forward (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] " Chain ufw-after-logging-input (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] " Chain ufw-after-logging-output (1 references) target prot opt source destination Chain ufw-after-output (1 references) target prot opt source destination Chain ufw-before-forward (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp source-quench ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ufw-user-forward all -- anywhere anywhere Chain ufw-before-input (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-logging-deny all -- anywhere anywhere ctstate INVALID DROP all -- anywhere anywhere ctstate INVALID ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp source-quench ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc ufw-not-local all -- anywhere anywhere ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900 ufw-user-input all -- anywhere anywhere Chain ufw-before-logging-forward (1 references) target prot opt source destination Chain ufw-before-logging-input (1 references) target prot opt source destination Chain ufw-before-logging-output (1 references) target prot opt source destination Chain ufw-before-output (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-user-output all -- anywhere anywhere Chain ufw-logging-allow (0 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] " Chain ufw-logging-deny (2 references) target prot opt source destination RETURN all -- anywhere anywhere ctstate INVALID limit: avg 3/min burst 10 LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] " Chain ufw-not-local (1 references) target prot opt source destination RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10 DROP all -- anywhere anywhere Chain ufw-reject-forward (1 references) target prot opt source destination Chain ufw-reject-input (1 references) target prot opt source destination Chain ufw-reject-output (1 references) target prot opt source destination Chain ufw-skip-to-policy-forward (0 references) target prot opt source destination DROP all -- anywhere anywhere Chain ufw-skip-to-policy-input (7 references) target prot opt source destination DROP all -- anywhere anywhere Chain ufw-skip-to-policy-output (0 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain ufw-track-forward (1 references) target prot opt source destination Chain ufw-track-input (1 references) target prot opt source destination Chain ufw-track-output (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere ctstate NEW ACCEPT udp -- anywhere anywhere ctstate NEW Chain ufw-user-forward (1 references) target prot opt source destination Chain ufw-user-input (1 references) target prot opt source destination <b>ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT udp -- anywhere anywhere udp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:1935 ACCEPT udp -- anywhere anywhere udp dpt:1935 ACCEPT udp -- anywhere anywhere multiport dports 16384:32768 ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT udp -- anywhere anywhere udp dpt:https ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT udp -- anywhere anywhere udp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:5090 ACCEPT udp -- anywhere anywhere udp dpt:5090 ACCEPT tcp -- anywhere anywhere tcp dpt:sip ACCEPT udp -- anywhere anywhere udp dpt:sip ACCEPT tcp -- anywhere anywhere tcp dpt:5066 ACCEPT udp -- anywhere anywhere udp dpt:5066 ACCEPT tcp -- anywhere anywhere tcp dpt:tproxy ACCEPT udp -- anywhere anywhere udp dpt:8081 ACCEPT tcp -- anywhere anywhere tcp dpt:8082 ACCEPT udp -- anywhere anywhere udp dpt:8082 ACCEPT tcp -- anywhere anywhere tcp dpt:3000 ACCEPT udp -- anywhere anywhere udp dpt:3000 ACCEPT tcp -- anywhere anywhere tcp dpt:2855 ACCEPT udp -- anywhere anywhere udp dpt:2855 ACCEPT tcp -- anywhere anywhere tcp dpt:2856 ACCEPT udp -- anywhere anywhere udp dpt:2856</b> Chain ufw-user-limit (0 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] " REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain ufw-user-limit-accept (0 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain ufw-user-logging-forward (0 references) target prot opt source destination Chain ufw-user-logging-input (0 references) target prot opt source destination Chain ufw-user-logging-output (0 references) target prot opt source destination Chain ufw-user-output (1 references) target prot opt source destination 

所选区域是用户规则的位置，已通过以下命令进行注册：

对于端口：

sudo ufw allow ssh （按端口名称）
sudo ufw allow 22 （具体指定端口号）
sudo ufw allow 80/udp （具体指定端口号和tcp或udp协议）

对于端口范围：

 sudo ufw allow 16384:32768/udp 

删除规则：

 sudo ufw delete allow 80 

我使用bbb的示例介绍了配置ufw的过程。

首先，我们看一下哪些端口正在侦听哪些服务：

 netstat -ntlp | grep LISTEN 

tcp 0 0 xxx.xxx.xxx.x:5090 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 127.0.0.1:8100 0.0.0.0:* LISTEN 1720/soffice.bin
tcp 0 0 xxx.xxx.xxx.x:5060 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 127.0.0.1:8101 0.0.0.0:* LISTEN 1766/soffice.bin
tcp 0 0 127.0.0.1:8102 0.0.0.0:* LISTEN 1811/soffice.bin
tcp 0 0 127.0.0.1:8103 0.0.0.0:* LISTEN 1856/soffice.bin
tcp 0 0 xxx.xxx.xxx.x:2855 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 127.0.0.1:8104 0.0.0.0:* LISTEN 1902/soffice.bin
tcp 0 0 xxx.xxx.xxx.x:2856 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN 1186/mongod
tcp 0 0 xxx.xxx.xxx.x:5066 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 1227/redis-server 1
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1359/nginx -g daemo
tcp 0 0 xxx.xxx.xxx.x:8081 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 xxx.xxx.xxx.x:8082 0.0.0.0:* LISTEN 1258/freeswitch
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1176/sshd
tcp 0 0 0.0.0.0:3000 0.0.0.0:* LISTEN 1195/node
tcp6 0 0 ::1:5090 :::* LISTEN 1258/freeswitch
tcp6 0 0 ::1:5060 :::* LISTEN 1258/freeswitch
tcp6 0 0 127.0.0.1:8005 :::* LISTEN 1341/java
tcp6 0 0 :::5070 :::* LISTEN 1461/java
tcp6 0 0 :::9999 :::* LISTEN 1461/java
tcp6 0 0 :::1935 :::* LISTEN 1461/java
tcp6 0 0 :::8080 :::* LISTEN 1341/java
tcp6 0 0 :::80 :::* LISTEN 1359/nginx -g daemo
tcp6 0 0 ::1:8081 :::* LISTEN 1258/freeswitch
tcp6 0 0 ::1:8082 :::* LISTEN 1258/freeswitch
tcp6 0 0 :::8021 :::* LISTEN 1258/freeswitch
tcp6 0 0 :::22 :::* LISTEN 1176/sshd
tcp6 0 0 :::5080 :::* LISTEN 1461/java

我们对带有xxx.xxx.xxx.x（xxx.xxx.xxx.x是服务器的IP地址）的行感兴趣，因为这表明该服务正在网卡上侦听来自所有网络的传入请求（0.0.0.0:*） 。 带有127.0.0.1的行对我们不感兴趣，因为这是内部接口，因此我们也对第4列中带有0.0.0.0的行（以粗体突出显示）感兴趣。

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1359/nginx -g daemo

正如它说的那样，端口80对所有服务器接口都是开放的，并接受来自所有网络的请求。

因此，据此我们制定了规则：

sudo ufw allow 22 for ssh
sudo ufw allow 80用于Nginx或Apache Web服务器

freeswitch的许多规则：

 sudo ufw allow 5060 sudo ufw allow 5090 sudo ufw allow 2855 sudo ufw allow 2856 sudo ufw allow 5066 sudo ufw allow 8081 sudo ufw allow 8082 

对于节点服务：

sudo ufw allow 3000
接下来，您需要查看文档，我们将在其中看到有必要打开以下端口：

sudo ufw allow 16384:32768/udp用于WebRTC
sudo ufw allow 443
sudo ufw allow 1935

这样就完成了BigBlueButton 2.0服务器的基本ufw设置。

我只会补充说，希望禁用ssh或更改端口，或仅将此端口用于特定网络，例如贵公司的网络。

例如，您的网关有两个网络接口，一个是虚拟的（对用户）192.168.3.2，另一个是真实的105.xxx.xxx.xxx（对提供商），在这里，对于ufw规则，我们采用一个真实的ip，或者更确切地说，指明它所属的网络ip。

首先，更改SSH服务器配置文件中的端口，可以使用任何文本编辑器：

 vim /etc/ssh/sshd_config 

然后我们删除允许端口22的规则：

Sudo ufw delete allow 22有时称为OpenSSH。

我们创建一个规则，仅允许从企业网络连接到新端口：

 sudo ufw allow from 105.../26 to any port 4321 

然后，我们重新启动ssh服务：

 /etc/init.d/ssh restart 

并查看结果

 netstat -ntlp | grep LISTEN 

 tcp 0 0.0.0.0:4321 0.0.0.0:* listen 5676/sshd 

在ufw规则中，我们将看到谁有权访问该端口：

 ufw status 

 4321 ALLOW 105.xxx.xxx.xxx/26 

尊敬的读者，我要求您在注释中添加其他内容：您是否认为此处一切描述正确，还是有必要添加或删除某些内容？