Question

4

IRC service and UFW firewall rules

rated 0 times [ 4] [ 0] / answers: 1 / hits: 2552 / 2 Years ago, mon, august 22, 2022, 12:56:47

I am securing my computer and have created same rules by utilizing UFW at CLI.

My question is this, in order to allow IRC services with XChat 2.8.8, and because IRC service uses ports 6667 through 7000, do I have to write a rule for each port, like:

sudo ufw allow out 6667/tcp

sudo ufw allow out 6668/tcp

sudo ufw allow out 6669/tcp

....

sudo ufw allow out 7000/tcp

Or can I do something this way:

sudo ufw allow out 6667:7000/tcp

On the same subject let me ask you another question, does IRC just uses TCP protocol or do I also have to write equal rules for the UDP protocol?

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

fittecanap

Add To Favorites

Follow

Total Points: 322

Total Questions: 100

Total Answers: 105

Location: Israel

Member since Tue, Nov 17, 2020

4 Years ago

answered 2 Years ago earxcept · Accepted Answer

The manpage of ufw in the RULE SYNTAX section explains the port range part of your question quite well I guess. Hard to get an excerpt with only relevant information from it, so to summarize by example:

/tcp just makes the rule only match TCP. Removing that will match all traffic, including UDP and possibly other future protocols with port numbers.

Ranges are indeed specified as you described. 6667:7000 matches all ports from 6667 up to and including 7000.

Multiple ranges or individual ones can be separated by commas, e.g. 6667,6669:7000 will be the same as above, but excluding 6668.

Wikipedia on IRC mentions this as the protocol/ports required to use it:

IRC was originally a plain text protocol (although later extended),
which on request was assigned port 194/TCP by IANA. However, the
de facto standard has always been to run IRC on 6667/TCP and
nearby port numbers (for example TCP ports 6660–6669, 7000) to
avoid having to run the IRCd software with root privileges.

So, this should do the trick for most common outgoing IRC connections:

sudo ufw allow out 6660:7000/tcp

And look for documentation on the IRC server you're connecting to if available. For example FreeNode:

All freenode servers listen on ports 6665, 6666, 6667, 6697 (SSL only), 7000 (SSL only), 7070 (SSL only), 8000, 8001 and 8002.