Hey there folks,

I’m trying to figure out how to configure my UFW, and I’m just not sure where to start. What can I do to see the intetnet traffic from individual apps so I can know what I might want to block? This is just my personal computer and I’m a total newbie to configuring firewalls so I’m just not sure how to go about it. Most online guides seem to assume one already knows what they want to block but I don’t even know how/where to monitor local traffic to figure out what I can/should consider blocking.

  • fool
    1·
    2 months ago

    Lots of good answers here but I’ll toss in my own “figure out what you need” experience from my first firewall funtime. (Disclaimer: I used nftables – it should be similar to ufw in terms of defaults though).

    • Right off the bat, everything unneeded was blocked. I “needed” no configuration, except for maybe…
    • Whatever CUPS runs on (when I use it)
    • Sometimes I ran python -m http.server – I unblocked port 8000 for personal use.
    • I chose to unblock port 53 (DNS). I wanted to connect to another computer via hostname IIRC (e.g. connecting to raspberry-pi.local. I might be misremembering this though).
    • At one point I played with NGINX – that’s port 80 (HTTP) and port 443 (HTTPS).
    • SSH was already permitted (port 22 – you need root access to enable traffic through ports below 1024 anyway so this wasn’t an issue for running typical apps)

    I didn’t use WireShark back then, really. I think I just ran something like

    sudo lsof -nP -iTCP -sTCP:LISTEN

    which showed me a bunch of port traffic (mostly just harmless language servers).

    You don’t have to dive to deep into all the “egress” and “ingress” and whatnot unless you’re doing something special. Or your software uses a weird port. (LocalSend lol)