Outbound Firewall On Linux Isn’t Worth It

UFW is the Firewall tool used for Ubuntu Linux, allowing the user to define basic policies for the Firewall. Many users advocate the use of an outbound firewall, the reason being that at a very simple level an attacker who can’t get outbound access is in trouble. The issue is that outbound firewalls are easy to bypass on Linux, especially without restraining applications via LSM or with a separate user.

I set up UFW and an outbound firewall and found it to be a bit of a pain. I spent the time going through logs to get Pidgin working with XMPP and then after all of that was done I had to figure out how to get Tinychat working in my browser.

And for what? Nothing, really. I can prevent really unsophisticated automated attacks that will fail if they can’t find the exact port they want – not exactly a huge boon to my security.

The ‘pain’::’gain’ ratio here is heavily leaning to pain. There’s always a trade off for security but when there’s not much security and a ton of maintenance it’s just not worth it.

I advocate an outbound firewall on servers and systems where you’re willing to separate services and processes to separate UIDs and configure everything accordingly, just be aware that it’s probably not worth it if you’re a typical user.