VPS & Server audit fixes

Firewall & Network: fixing all 6 checks

The firewall and network audit asks two things of the host itself: which ports are listening on an external interface, and whether anything on the box is filtering the traffic that reaches them.

Two checks are automated for UFW only, so on a firewalld, nftables or plain iptables host, Firewall Allow Rules and Outbound Firewall Policy both skip even when you run as root with everything else in place. The remaining skips are privilege, since four of the six checks need root to read firewall state, or a missing tool: no ufw, firewall-cmd, nft or iptables at all, neither ss nor netstat, no Docker daemon it can query, or no iproute2 for the IPv6 check.

6
checks in this audit
2
rated high severity
4
need root or sudo
~14s
automated run time

Transcribed from the vps-security-firewall-network audit script. For what the audit covers rather than how to fix it, see the Firewall & Network checklist.

Every check

Find your finding

Listed in the order the audit runs them. Take the check name from the third field of the result line and open its page.

  • Firewall State

    Soon

    Checks whether a firewall (UFW, firewalld, nftables, iptables) is present and active

    HighNeeds root3 results

  • Firewall Allow Rules

    Soon

    Audits configured firewall allow rules (UFW)

    MediumNeeds root3 results

  • Docker Firewall Bypass

    Soon

    Checks for Docker containers publishing ports on all interfaces, bypassing the firewall

    HighNeeds root3 results

  • Open Ports

    Soon

    Lists services listening on external interfaces

    MediumNo root4 results

  • IPv6 Firewall Coverage

    Soon

    Checks whether IPv6 traffic is covered by the firewall

    MediumNo root4 results

  • Outbound Firewall Policy

    Soon

    Checks the default outbound/egress firewall policy

    LowNeeds root3 results
Why checks skip

A SKIP is never a pass

A skipped check verified nothing at all. The most common cause is privilege: 4 of the 6 checks in this audit need root for a complete result. Before every run, each script works out which of four privilege modes it is in.

The four privilege modes an audit script can run in, and what each one means for checks that need root
ModeHow it is reachedWhat it means for your results
rootThe audit runs as UID 0.Every privileged branch runs directly. No check skips for lack of permission.
nopasssudo -n true succeeds, so the account has passwordless sudo.Privileged commands run through sudo -n.
passA sudo password was supplied in the CtrlOps audit settings and accepted.Privileged commands run through sudo -S.
noneNone of the above worked.CAN_ROOT=0. Every privileged branch returns SKIP with a "Need root" message rather than guessing.

If many checks skip with a “need root” message, run the audit as root, grant the audit account sudo (with or without NOPASSWD), or supply the sudo password in the CtrlOps audit settings.

Keep going

Related audits

FAQ

Firewall & Network questions

The result is correct for what the check measures, which is filtering on the host itself: ufw status, firewalld state, an nftables ruleset, or an iptables INPUT chain with a DROP or REJECT policy. AWS security groups, DigitalOcean Cloud Firewalls and Hetzner firewalls all filter before traffic reaches the VM and are invisible to anything running on it. Relying on them alone is a defensible architecture, but the audit takes the defence-in-depth position, so either enable a host firewall as a second layer or record this as an accepted exception.
Both. ss and netstat report the address a socket is bound to, not whether anyone outside can reach it, so a port bound to 0.0.0.0 behind a host firewall or a cloud security group still counts here. The check drops 127.0.0.1 and ::1, counts TCP and UDP together, warns above five total, and fails outright on ports 23, 21, 3389, 5900, 5901, 11211, 873, 2049 and 111 wherever they appear externally. Use it as the inventory of what is bound and an external nmap as the test of what is reachable.
Allow the SSH port before you enable anything: sudo ufw allow 22/tcp, using the port the SSH audit reported rather than assuming 22, then sudo ufw enable and confirm with sudo ufw status while your existing session stays open. Do not try to fix the Docker Firewall Bypass warning with a ufw rule, because Docker publishes ports through the FORWARD chain and its own rules sit ahead of yours. The fix there is the port mapping itself: publish as 127.0.0.1:8080:80 instead of 8080:80 for anything that is not meant to be public.
Audit your fleet

Run all 6 Firewall & Network checks, in one click

CtrlOps runs this audit over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals