This is production server and I need to add rules very carefully, I don't sure what is correct rule.
Currently my UFW rules allow SSH connection from any IP and from WireGuard, also my own IP (YYY.YYY.YYY.YYY) allow me connect to any ports. Currently any other IPs can connect through VPN and directly.
# sudo ufw status numbered
Status: active
To Action From
-- ------ ----
[ 1] XXXXX/udp ALLOW IN Anywhere
[ 2] OpenSSH ALLOW IN Anywhere
[ 3] Anywhere ALLOW IN YYY.YYY.YYY.YYY
[ 4] Anywhere on eth0 ALLOW FWD Anywhere on wg0
[ 5] XXXXX/udp (v6) ALLOW IN Anywhere (v6)
[ 6] OpenSSH (v6) ALLOW IN Anywhere (v6)
[ 7] Anywhere (v6) on eth0 ALLOW FWD Anywhere (v6) on wg0
This is my WireGuard config on server
#cat /etc/wireguard/wg0.conf
[Interface]
PrivateKey = .............................=
Address = 10.8.0.1/24, fd..:....:....::1/64
ListenPort = XXXXX
SaveConfig = true
PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PostUp = ip6tables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PreDown = ufw route delete allow in on wg0 out on eth0
PreDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PreDown = ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
I need to forbid direct connection from other IPs, any IPs except my IP can connect only with VPN.
For example I have a lot of opened JAVA ports and one opened SMB port, this is need for my application:
#sudo netstat -tulpn | grep LISTEN
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 557/systemd-resolve
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 641/sshd: /usr/sbin
tcp6 0 0 :::37111 :::* LISTEN 1005/java
tcp6 0 0 :::36069 :::* LISTEN 630/java
tcp6 0 0 :::2181 :::* LISTEN 1005/java
tcp6 0 0 :::9092 :::* LISTEN 630/java
I need to save JAVA opened ports and SSH ports for my IP YYY.YYY.YYY.YYY, but need to closed this ports from other IPs outside of VPN. And unfortunately SMB port need to open to any IP, this need to this server.
What UFW rules I need to add (or maybe changed Wareguard config) in order to allow only one IP (YYY.YYY.YYY.YYY) to connect directly and any other IPs can connect only from VPN and can connect to any server ports only with WireGuard.
