Part 6: Security layer

29. Tighten the firewall#

What you'll do: stop accepting SSH from "anywhere". Allow it only from your home network and Tailscale. Then check the router. Time: 20 minutes.

Before this chapter, SSH accepts connections from anywhere. After it:

flowchart LR
  H["Home network<br/>192.168.1.0/24"] -- "allowed" --> S["SSH :22"]
  T["Tailscale<br/>tailscale0"] -- "allowed" --> S
  X["Any other network<br/>(café, work Wi-Fi)"] -. "blocked" .-x S

This matters most if the server is ever plugged into a network that isn't yours.

Step 1: Find your home network#

ip -4 route show scope link

The first word of the line is your home network, e.g. 192.168.1.0/24. Use that whole value, including /24, below. It's a range, not one address.

Step 2: Add the narrow rules FIRST#

sudo ufw allow in on tailscale0 to any port 22 proto tcp comment 'SSH over Tailscale'
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp comment 'SSH from home'
sudo ufw allow from 192.168.1.0/24 to any port 5353 proto udp comment 'homeserver.local'

(Use your own network instead of 192.168.1.0/24.)

Test from a new window, both ways:

ssh homeserver
ssh homeserver-remote

Both must work. Only then continue.

Step 3: Remove the broad rules#

sudo ufw status numbered

You'll see a numbered list. The broad ones from Chapter 12 look like:

[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 5353/udp                   ALLOW IN    Anywhere
[ 6] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 7] 5353/udp (v6)              ALLOW IN    Anywhere (v6)

Delete one of them, by its number:

sudo ufw delete 1

Type y to confirm. The numbers change after every delete, so run sudo ufw status numbered again and pick the next broad rule by its new number. Repeat until no rule says Anywhere for port 22 or 5353.

Test again from a new window: ssh homeserver and ssh homeserver-remote.

Step 4: Check IPv6 is covered#

grep '^IPV6=' /etc/default/ufw

Expected: IPV6=yes. If it says no, change it with sudo nano /etc/default/ufw, then sudo ufw reload.

Step 5: Check the router#

Log in to your router's admin page (see Chapter 6) and check:

• Port forwarding / NAT / Virtual server: nothing points to the server. Delete anything you don't recognise.
• Remote administration / Access from WAN: off.
• UPnP: off, unless a game console or app really needs it.
• IPv6 firewall: on, blocking incoming connections.
• Router admin password changed from the default.

Step 6: Final look#

sudo ufw status verbose

You want Status: active, Default: deny (incoming), and only your narrow rules. If you have Part 5, check the AI guard is untouched:

systemctl is-active ai-egress-guard

Next: 30. Check the clock