Comments (3)
Thanks for your continued feedback on UFW configuration @Bronislawsky ... it has been janky since the beginning.
This is now fixed in our user.rules
boilerplate:
### tuple ### allow tcp 80,443 0.0.0.0/0 any 0.0.0.0/0 in
-A ufw-user-input -p tcp -m multiport --dports 80,443 -j ACCEPT
### tuple ### allow tcp @SSH_PORT 0.0.0.0/0 any 0.0.0.0/0 in
-A ufw-user-input -p tcp --dport @SSH_PORT -j ACCEPT
Ref: https://github.com/littlebizzy/slickstack/blob/master/ufw-firewall/user-rules.txt
Ref: https://github.com/littlebizzy/slickstack/blob/master/ss-install-ufw.txt
I'm not necessarily opposed to setting up rules using CLI commands, esp. since UFW is rather fragile. However, if we stop using a boilerplate then I'm concerned users will start customizing UFW rules, and SlickStack will have less predictability.
Since we want to make a very simple and predictable LEMP stack, I'm hoping to retain user.rules
especially since the format and networking order of before.rules
and after.rules
seem a bit complex, idk.
Definitely could use some feedback on other sections too:
*filter
LOGGING
RATE LIMITING
from slickstack.
Thank you very much
from slickstack.
Just an update on this, I've now also added a boilerplate for user6.rules
for IPv6 support as well... to verify that both IPv4 and IPv6 rules are running correctly type sudo ufw status verbose
and it should look like:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
80,443/tcp ALLOW IN Anywhere
6969/tcp ALLOW IN Anywhere
80,443/tcp (v6) ALLOW IN Anywhere (v6)
6969/tcp (v6) ALLOW IN Anywhere (v6)
from slickstack.
Related Issues (20)
- Allow tuning of PHP8 JIT settings (opcache.jit options in php.ini) HOT 4
- Cloudflare real visitor IP support in Nginx config HOT 18
- Option to allow only Cloudflare IPs to connect to origin server HOT 2
- OpenVZ PHP-FPM "Unable to set priority for the master process: Permission denied" HOT 9
- Support for custom Permissions Policy HTTP header in Nginx HOT 6
- Improve WP-Cron robustness for Multisite environments HOT 3
- Scanning WordPress core files to check if intact or broken HOT 4
- Redirect .php extension to WordPress if not exists HOT 4
- Why deny /wp-admin/load-styles.php and /wp-admin/load-scripts.php? HOT 3
- Nginx access log enabled by default but nginx.conf says not HOT 5
- Spam Content HOT 1
- Expose additional options for ss remote backup HOT 2
- support for local development ? HOT 1
- 403 Error on Static Assets with Query Strings on SlickStack.io HOT 1
- Implement Server-Wide Connection Limit to Mitigate Request Overload HOT 1
- ss-config had a build version update, but ss-update-config didn't HOT 4
- Can't get it to work out of the box? HOT 1
- 403 google bot error
- Consider optional cache warming script that can fire on cron schedules
- Can't install due to 403 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from slickstack.