Kali Linux Host-Based Firewall

I decided to make a firewall on my current Kali Linux VM. Rather than use an application like pfSense, I chose a host-based firewall. While some of the work I completed in my classes was related to this, much of it was new, so I used several resources, including some AI, to help me progress while still learning from the project. I wanted to start with something simple, so I opted to set up and test a UFW (Uncomplicated Firewall). I have worked with pfSense and setting up firewalls before (including configuring my own on my PC in the past, but I have only set up a UFW once, quite some time ago, so this was a fun project.

Here are the first few steps taken during the completion of this project, and my reflection on what I learned and some of the challenges I faced.
To view the rest of the project, visit the full documentation here!

Project Reflection:

This project helped me gain a stronger understanding of how host-based firewalls work to control network traffic. Throughout this project, I configured an Uncomplicated Firewall (UFW) on a Kali Linux Virtual Machine, set incoming traffic to be denied by default, then created a rule to explicitly allow SSH traffic. Then, I used an Ubuntu VM and Nmap to test a temporary web server running on port 8080. I altered the specific firewall rules regarding traffic over port 8080 and re-ran the Nmap scans several times to verify that the firewall was working as intended. I had some prior knowledge of firewalls from past classes during my time at Old Dominion University, but most of the knowledge was related to pfSense and Windows Defender firewalls, so this was a great learning opportunity to expand my knowledge of host-based firewalls.

I ran into a few issues with VMs not being updated or Nmap not being installed correctly, but these issues were easy to work past and provided useful insight into basic troubleshooting. Overall, this was a great learning experience and a fun project to work on. It was a simple project, but one that provided relevant knowledge and experience when pursuing a career in Cybersecurity.

Kali Linux Host-Based Firewall Project Steps

Step 1 – Update Kali, install UFW, and enable UFW:

For the initial update of Kali, it took significantly longer than I would have expected. This could have been due to this particular machine being idle for a few months while in college, or it could have been due to an unstable internet connection. Regardless, once it completed, I was able to begin the installation of UFW.

Once the update completed, I installed UFW. This was a very fast install, whereas the update took well over 15 minutes. This was a super simple thing to do, as Linux preconfigures all of the packages, and the command to install it was extremely straightforward. The commands ‘apt update’ and ‘apt install’ are some of the most important basic commands you need to know and will help you get started on various projects.

Now, after UFW was installed, a simple “sudo ufw enable” command enabled the firewall. By default, this host-based firewall becomes active upon my system’s startup, meaning I don’t manually have to remember to turn it on each time I log onto my VM.

Step 2 – Establish a Baseline:

Establishing a baseline involves checking the current (often default) configuration before making changes. This is what I am doing with my firewall next. I will be checking my current configuration before making any changes.

The command ‘sudo uft status verbose ‘ allows me to check the status and configuration for the firewall. The keyword ‘Status ‘allows me to view if it is active or inactive, while ‘verbose’ provides additional information such as basic policies, which are currently unchanged from the default.

The ‘ip addr’ command allows me to look at my network information. There is some super important information here, such as my interface name, IP, subnet information, and whether the interface is currently up. This information is crucial when you are trying to test the firewall from another machine. I may have to make some changes to my network on this VM in the future to allow communication between separate VMs.

This command is one of the most important for the baseline, and while usually you would see TCP or UDP Traffic present below the columns, the fact that there is nothing beneath them means that there are no listening TCP/UDP sockets detected by this command. Hopefully this does not cause issues later, but if it does, I will come back to fix it.

Netid: Type of Network Connection.
State: Current State (such as LISTEN).
Recv-Q (Data waiting to be received).
Send-Q (Data waiting to be sent).
Local Address:Port: Kali VM’s address and listening port.
Peer Address: The computer it is connected to.

With this baseline established, as mentioned before, I was able to gain an understanding of how this UFW is configured before any changes, security or otherwise, are made. Establishing a baseline is important in more than just firewalls, and is especially important in monitoring situations. Generally, users need to establish a baseline to know what normal looks like. This allows for easier detection of anomalies or behavior that strays suspiciously far from normality.