UCS 2.4 - Univention

10.3 Packet filter with Univention Firewall
10.3 Packet filter with Univention Firewall
Univention Firewall offers an integration of the packet filter IPTables into Univention Corporate Server. This
filter permits targeted filtering of undesired services, and the protection of computers during installation
works. Furthermore it provides the basis for complex scenarios such as firewalls and Application Level
Gateways. Univention Firewall is included in all Univention Corporate Server installations as a standard
feature.
The configuration for the packet filter can be found in the directory /etc/security/netfilter.d/.
The configuration elements available in this directory, are executed in alphabetical order. The name of
each script begins with two digits, which makes it easy to create a numbered order.
After changing the packet filter settings, the service univention-iptables has to be restarted.
Univention Firewall can be deactivated by setting the Univention Configuration Registry variable
security/packetfilter/disabled to true.
10.3.1 Service definitions
Univention Firewall allows selective filtering of individual services by Univention Configuration Registry, for
example if a service is temporarily not required or to be deactivated for test purposes. At present, the
following services are supported in UCS:
smtp pop3 imap kerberos
krsh nfs umc nagios
ipp notifier dhcp dns
ftp http x11 https
ldap postgres samba ssh
telnet ftp
If the Univention Configuration Registry variable security/services/SERVICE is set to disabled, the cor-
responding service is filtered out.
Attention:
These services are filtered by means of their default ports. If a service is operated at a different port, then
the corresponding Univention Configuration Registry template has to be adapted.
10.3.2 Service profiles
Univention Firewall supports pre-defined service profiles for each system role. The services to be filtered
out, are defined for each role in the above-mentioned Univention Configuration Registry settings.
Attention:
It has to be considered that it is merely a selective filter which is used here. If additional local services are
applied, they have to be registered subsequently.
223