Skip to content

firewall.md

Latest commit

 

History

History
50 lines (37 loc) · 2.02 KB

firewall.md

File metadata and controls

50 lines (37 loc) · 2.02 KB
Raw
type how-to
title Firewall (UFW)
description Install and manage a UFW firewall baseline for an Odoo server.
tags
security
firewall
ufw
audience
operator
updated 2026-10-08

Firewall (UFW)

From the main menu Firewall (UFW), the tool installs and manages a UFW firewall for the server. It shows ufw status verbose each time you enter.

Install / configure secure baseline

Applies a secure baseline:

  1. Installs UFW if missing.
  2. default deny incoming, default allow outgoing.
  3. Allows the SSH port — before enabling UFW, so you are not locked out. The tool proposes the port SSH listens on (sshd -T, and ssh.socket on Ubuntu 24.04), and asks for confirmation if you choose another.
  4. Allows HTTP (80) and HTTPS (443) if chosen.
  5. Optionally allows PostgreSQL (5432) from a single app-server IP.
  6. Enables UFW (last step).

Warning: double-check the SSH port before applying — a wrong SSH rule with deny incoming can lock you out of the server. The plan is previewed before anything runs.

Other operations

  • Allow a port — ufw allow <port>/<tcp|udp>.
  • Delete a rule (by number) — lists the numbered rules and deletes one only if that number still shows the same rule when the plan runs: fail2ban adds its bans at the top of the list, which shifts the numbers. A rule that lets SSH in (its port, or the OpenSSH profile) is deleted only after you confirm the risk.
  • Enable / Disable UFW — enabling allows the ports SSH listens on first; when none is detected, you confirm before it goes up.

The PostgreSQL rule takes one address (the app server's), never a network or any.

Relationship with Fail2ban

Fail2ban bans through UFW (ufw for SSH and recidive, the tool's ufw-odoo-web for the web ports), so its bans only take effect when UFW is installed and active — this menu is how you make that true.

Related