doc/networking/firewall: add more restrictive UFW rules #12266
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ru-fu
force-pushed
the
more-restrictive-fw-rules
branch
from
88304ed to
948abb7
Compare
simondeziel
reviewed
Sep 18, 2023
|
|
||
| # allow the guest to have access to outbound connections | ||
| # determine <IPv4> with: lxc network list | grep lxdbr0 | ||
| sudo ufw route allow in on lxdbr0 from <IPv4> |
There was a problem hiding this comment.
I think we should make it easy to copy and paste (as well as explain what it does):
CIDR4="$(lxc network get lxdbr0 ipv4.address | sed 's|\.[0-9]\+/|.0/|')"
CIDR6="$(lxc network get lxdbr0 ipv6.address | sed 's|:[0-9]\+/|:/|')"
sudo ufw route allow in on lxdbr0 from "${CIDR4}"
sudo ufw route allow in on lxdbr0 from "${CIDR6}"
948abb7 to
2255e6d
Compare
|
Thanks! Updated now - but please check, not sure I understood it 100%. ;) |
No. Those rules don't specify an ip address so they will apply to both ipv4 and ipv6 rulesets. The suggestion in #12266 (comment) was good because my initial suggestion for the route rule was ipv4 specific, so adding an ipv6 specific rule made a lot of sense. |
Add an example for more restrictive firewall rules. Closes canonical#11824 Signed-off-by: Ruth Fuchss <[email protected]>
ru-fu
force-pushed
the
more-restrictive-fw-rules
branch
from
2255e6d to
fe67eed
Compare
tomponline
approved these changes
Oct 25, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an example for more restrictive firewall rules.
Based on @jdstrand suggestions #11824 (comment)