UFW防火墙配置与日志解析-优快云博客

添加规则

允许123.123.123.0/22网段所有ip访问本机80,3306端口

ufw allow proto tcp from 123.123.123.0/22 to any port 80,3306

删除一条规则

ufw delete allow 80

查看 UFW 的状态

ufw status

Status: active
To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443                        ALLOW       Anywhere
22 (v6)                    ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)

ufw status numbered (带序号)

LOGGING日志

ufw支持多种日志级别。默认为“低”。用户可使用下面的命令指定日志级别：

ufw logging LEVEL

级别分为 关闭\低\中\高\完全。区别如下：

off    disables ufw managed logging

关闭关闭日志记录

low    logs all blocked packets not matching the default policy (with rate  lim‐
             iting), as well as packets matching logged rules

低记录所有被默认策略阻止的数据（速率限制），以及符合规则的数据。

medium log  level low, plus all allowed packets not matching the default policy,
             all INVALID packets, and all new connections.  All logging is  done  with
             rate limiting.

中低级别+不符合默认策略是数据+无效数据+所有新连接。所有记录在速率限制下进行。

high   log level medium (without rate limiting), plus all packets with rate lim‐
             iting

高中级（取消速率限制）+速率限制下的所有数据包

full   log level high without rate limiting

完全高级无速率限制。

日志解析

常规日志类似于下面这样，位于 /var/logs/ufw：

Sep 16 15:08:14 <hostname> kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=123.45.67.89 DST=987.65.43.21 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=8475 PROTO=TCP SPT=48247 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0