UFW Ports Open Option

General
1

I’ve sometimes ran into the issue where an app that required ports is unable to properly function, due to those same ports that it needs being closed. For example, I’ve personally ran into issues where KDE Connect is unable to connect to my phone, due to necessary UFW ports being closed. Many others have also experienced this. People have also experienced issues with Sunshine/Moonlight not working due to this port shutoff. While I am aware some have raised concerns about this, I feel like my argument branches differently enough to constitute a new topic.

To start, the only way to enable these ports is using the terminal, and while yes, the commands to do so are extremely simple, I feel like it is important to view it from the perspective of a largely significant user-base that is being introduced to CachyOS. Let’s assume they are an “intermediate” power user, and are familiar with terminal commands, but prefer a GUI. They want to link their phone to their computer using KDE Connect, but they fail to. They Google the solution, and find out they can open some ports for the app using a specific set of commands. For a user that has been using the terminal for years, this is nothing to be bothered about, but for a user who prefers the GUI, even if they are comfortable with the terminal, this may make them think “Couldn’t this be simpler?”. It doesn’t feel like an overreaction to think that way, since it is such a simple thing that halts the functionality of the app.

Next, while I understand that at the end of the day, CachyOS is still Arch Linux, and you should expect more relative complexity than say, Linux Mint, the distro still aims for making the user-experience as friendly as it can be (within its philosophy). For example, in the CachyOS Hello app, within the “Apps/Tweaks” menu, there are options to “Install Gaming packages”. Additionally, those gaming packages include programs like Steam and the Heroic Games Launcher. Installing these commonly used programs gets a dedicated button, to make the user-experience more friendly. I feel it’s only fair to add a toggle function for opening or closing those ports for apps like KDE Connect and Sunshine.

Continuing with the idea of a toggled function for opening those ports, I feel this would be a good compromise for those concerned about security. Keeping those ports open is definitely a security risk, and I don’t believe we should just open any specific ones by default. But, this other extreme isn’t that great, as it forces people into the terminal for a simple function. I believe a good compromise to this would be adding its own button into the “Apps/Tweaks” section of the CachyOS Hello app. That way, it would respect both the wishes of users who prefer using the GUI and those who prefer keeping this security on their system.

2

There is always gufw which seems to have a preconfigured rule for KDE Connect:

602×720 37 KB

In case someone needs a GUI front-end for ufw to create firewall rules.

3

I don’t understand the purpose of these firewalls. If you want KDE Connect, the ports should be open. If you don’t have or use KDE Connect, there is no service running on that port and it’s “blocked”. What’s the point?

4

No it isn’t. I’ve swapped out ufw for firewalld so I can’t give a screenshot or similar, but e.g. the “flagship” KDE environment has a GUI for managing UFW firewall rules (plasma-firewall) that is included in the plasma-meta package. There’s also gufw for gnome/gtk folks.

Since you’re using KDE connect, it seems likely that you’re using KDE?

5
  1. They protect against malware by requiring intentional opt-in opening by a user with elevated privilege
  2. You might have services running that you only want accessible from your home network or just your local PC.
    1. Especially if on a laptop or other system that moves around

Personally I prefer the greater control over segmenting rules and automatically changing based on network that firewalld offers, but it’s absolutely not generalizable to “if you’re running services you want them open”

6

Mentioning not only KDE Connect i faced this issue with Waydroid to it was not able to connect to internet so fixed it by chaniging UFW ports , and maybe not onlt these 2 other programs have this issue too .

It’s and humble to request that please find 1 generalised solution to this , I’m matching the thing you said new "Intermediate " user who perfer gui (ik some cmd line but still not much into…) it becames frustation sometime and droping that things (i lack patience ik :frowning:

7

Yes protection is Key but there should be 1 general solu to it . , for not experienced used it not easy everytime .

8

It is documented.

In probably the first place one should look;


Pretty sure that is not true for either GUFW or plasma-firewall.
(Graphical frontends for firewalls)
ufw itself on the other hand is a cli application.


This would be a fine set of steps if it didnt end right there.
If it does then our imaginary user is a little silly for having ended their google search at that point.
If they dont want to use the terminal .. why do they assume after finding a single mention of terminal commands that that must be the only way?
Just an odd way to go about finding information from a search engine in general.


Does it?
I am not sure I can read that anywhere.
The closest is

which does not really mean the same thing you are saying.
It just says what it offers (maybe things like the optimized packages or its own tools like cachyos-rate-mirrors) would be useful to both old and new users.
It does not say anything about ‘making Arch easier for the absolute novice or windoze user’ or anything of the sort.


A shifting GUI based on some other packages is honestly too big an ask for such a minor thing, IMHO.

Then again I do not see the value (or worse) in around half or more of what is in that hello/welcome application so maybe I am too far removed from the target audience. :sweat_smile:

As already stated.. this is still Arch. Arguably more niche than Arch - which has its own official GUI installer these days so we cannot even say that is more or less ‘complicated’. Everything we touched on here already has dedicated sections in the docs.

If users want to be notified of every connection attempt then they should use something for that like opensnitch.


Finally and more generally..

I already think that UFW is not the best choice and that including ufw-extras, which just bluntly opens up dozens upon dozens of ports, is much too permissive.

I do not think opening up even more is a good idea of course.

At the very least I would prefer the ports are only opened to other devices on the same network and not like ‘the world’, ex;

I would technically support a toggle of some sort more than just a configured-to-be-open port. But I do not know how necessary that is either.

Having looked at the sunshine docs - they are laughable in mentioning this when arguably that is where the onus should be;

Thats it. The link was added by me to point back.

It has no further information - not which ports, let alone what explicit action the user might take, nothing.

If anything I would first be complaining to them about the state of their documentation.

9

I do agree with this, but I should’ve specifically mentioned that: There is no way to actually tell if the port is causing the error. In KDE Connect, if the devices can’t connect, they simply don’t show up to be selected on either one, essentially failing silently. As a result, there’s no way to tell that the lack of ports is causing the error. You could counter-argue that reading the Arch Linux wiki section about KDE Connect as the first thing they should do, but the fact that KDE Connect is pre-installed on the system will likely lead the user to assume that it’s set up and ready for them. With how CachyOS presents itself both pre- and post-installation doesn’t make this an unfair assumption. As a result, when KDE Connect simply doesn’t work, the user would likely assume something has gone wrong.

While yes, that is true, these graphical front ends aren’t installed with CachyOS. The fact they aren’t still adds to a bit of unnecessary complexity. You have to install a GUI app to open some ports of your firewall, complicating what should be a simple task, just to get a few necessary apps working.

My point is not that the user assumes that terminal commands are the only way, my point is that out-of-the-box, these GUI tools aren’t present, which overcomplicates things for the user. My fault, I didn’t communicate that properly.

It is said within the quote you provided: “a custom toolchain that streamlines the user experience for both new and experienced users.”. It’s also very clear that the developers adhere to this. This is seen with the inclusion of pre-installed software like the CachyOS Hello app, Shelly, the CachyOS Kernel Manager, and the Cachy-Update app.

While CachyOS’s stated goal isn’t the same as “making Arch easy for the novice or Windows user”, it still applies to this kind of predicament I’m referring to.

No offense at all, but I feel as though if that’s the case, then it may be quite difficult for you to understand the importance of GUIs to most users. Even those who frequently use the terminal prefer a GUI. It’s simpler having buttons do things for you, rather than having to venture into a wiki or somewhere else on the internet to find a command to do so.

I don’t understand. Yes, CachyOS is more niche than Arch, but I don’t see the relevance of bringing up Arch’s official GUI installer. Even then, I’m not exactly sure what you mean by that, because the closest one I can think of is archinstall, but that’s not really a GUI. You could also bring up the Arch Linux GUI project, but that’s not an officially endorsed part of Arch Linux.

That’s a very fair argument, and I would say it is quite necessary, considering the volume of confused people when it comes to why KDE Connect or Sunshine isn’t working OOTB. However, setting that up in the terminal would probably be more complex than having a simple button to do that. For a distro that has a custom toolchain to streamline the experience for new users, it would be a bit contradictory to willingly allow this, despite the complexity it adds to setting things up.

While their documentation is definitely weak, I still believe CachyOS is able to make its user experience better in spite of this. A simple button could easily suffice for the time spent searching, reading, finding a command to resolve the issue, and executing it in their terminal.

I do get that for users who prefer manual management through things like the terminal, things like these seem redundant. But take a look at it from the perspective of the userbase who prefers GUIs. Many people migrate to CachyOS for how streamlined it is with its setup and guidance, and a simple button that could be called “Enable Local Network Discovery” could easily bridge a bit more of the gap between security and OOTB usability.

10

The installer has a software selection section in which ..

Hm just looking again it is interesting to find that it appears they have removed ufw-extras (I mentioned above it opens many ports by default and I objected to its previous automatic inclusion) and just about everything else it seems besides ufw itself.

GUFW is kinda garbage with broken desktop files (for years!).

So the best option is the plasma thing but thats of course only for plasma.

Anyways that is to say I was going to correct this but no apparently its just ufw alone as the default now. plasma-firewall works as a graphical frontend but it is only listed under Plasma so might easily be missed.

Shelly is not official, a lot of the things you mentioned are quick or copies that provide specific functions, and still that quote does not say what you appear to think it is saying.

A toolchain “streamlining” an “experience” is not equal to “strives to make it dead-simple for newcomers to linux with a fancy GUI for every purpose and a nanny OS” or whatever else. I am not sure I even agree with the statement itself because they arent making Arch any more streamlined. One could very well argue the opposite. I also am not sure there are any native-english speakers involved so that could be related as well.

Anyways I am not aware of “make Arch easy to use for everyone” was, or is, part of the main mission here. I am aware of it being a performance-oriented Arch-derivative. Which means its weirder/more-temperamental/geekier than Arch.

Its more like I never liked the original this was a fork of.
And then I dont agree with the choices made for a fair portion of what is included.
And even for those I have some disagreements with how.
( The DNS being just one recent example of something that, even if it should exist at all, should probably exist differently. )
Not that I cannot possibly conceive of the usefulness of graphical buttons. :sweat_smile:

I am not sure I understood this thought.
Whether terminal or button both are ‘allowed’ and would ostensibly achieve the same thing. The only difference being that currently no such button exists .. while the terminal commands function anywhere the supporting software is installed.

Heck I dont even like ufw itself and prefer/use just nftables.


I am not sure we are ‘arguing’ over the same things here so let me reiterate;

We probably do not need all of the GUI welcome stuff we do have, we probably dont need to be using the hello/welcome base, and if we want something like cachyos-tweaks then that should be made. Preferably with current QT and not dead GTK (but again thats what the base is/was so thats what was inherited).
Now that GUI might include things but I would wager a certain portion of what is currently in Hello should not be.
Of those that should exist, including new ones, they may benefit from more preferred implementations.
If firewall counts in this arena instead of or alongside initial package selection we might still avoid using ufw entirely.
Does ‘open firewall ports’ count as one of these possibilities?
Maybe per-application?
Does sunshine count for that?
And if we do have an ‘open ports’ button of any kind it should probably by more thoughtful than simply open everywhere all the time, as already discussed.

Maybe the totality of that is a bit out of scope but there are a half dozen or so reasons why I do not exactly relish the idea of time put into more buttons for hello that do things in suboptimal ways.

11

plasma-firewall is installed with KDE.

12

I can’t really comment on how good GUFW is, since that’s not really something I’m too familiar with. And in general, I can’t really say anything about the quality of UFW itself, and even then, it’s not really my main point. As for plasma-firewall, I completely forgot to take that into account, and yeah, you’re right, it can easily be missed.

I feel like CachyOS including Shelly by default is official by itself. It may not be developed by them, but I would consider it official enough if it is bundled within. I’m not saying that the OS has to be dead-simple and a nanny OS, I’m saying this could just be a simple feature added to not make the process as complicated. It’s as reasonable as adding a button to “Install gaming packages”. I understand that you were not aware that part of CachyOS’s goal was to make Arch a little more easier to use for everyone, and I feel like taking in other perspectives could help you a bit more with this. To also address your point about non-native English speakers being involved, I’m not sure if that’s a fair point to make. The CachyOS team seems very much fluent in the English language, regardless of if they were native or not. I don’t believe that has relation to anything, honestly.

I never said or meant to imply that you couldn’t conceive the usefulness of them. As for the rest of your point, and I don’t mean to dismiss, and I mean this very, very nicely, but it seems like you’re talking about moreso a personal belief in how development decisions should’ve be made. I don’t see how this addresses my point in making the OOTB user experience better.

They would achieve the same thing, but my point is that a button would simplify the process in a good way. It would help reduce complaints about a relatively small issue like this. Sure, both do the same, but the GUI method would make things easier than the terminal method.

Look, whether CachyOS needs the GUI welcome stuff it has is entirely subjective. Some people like setting things up through the terminal and other manual means, but to be quite objective, a majority like setting things up through the GUI. Using the terminal for many tends to be a tedious experience, even if you may find enjoyment in it. CachyOS is definitely still taking an approach to user-friendliness in its design. I’m not referring to backends like QT, but rather I am arguing for a simple enhancement that makes the UI better. Using UFW or not is not what I am concerned with in my points, rather, I am concerned with how we implement changes in a user-friendly manner, with adding a button to open ports selectively for apps that need it being one of them. I do agree it should be more thoughtful than those ports simply being open all the time though.

That’s not a fair judgement. The feature hasn’t even been added, and you’re saying it’d be done in a suboptimal way without the developers having even added it.

I want to make it clear that I am arguing for more user-friendliness with this specific issue. By adding a button, it would simplify a tedious process. Whether they use UFW, and whether its good, is not what I am arguing in any capacity. I am simply trying to propose a user-friendly change that to me personally, just makes sense.

13

Apologies, you are correct about that. But the firewall is still sort of hidden within KDE Plasma settings, and Arch and CachyOS’s documentation don’t really refer to it explicitly. As a result, there is still the issue of user-friendliness to address.

14

Well being as ‘user-friendliness’ isn’t an Arch-feature, it would appear to be mostly out-of-scope, in my opinion. And best relegated to something tacked on from the AUR in my opinion. Until and unless a proven tool exists, whether that be developed in-house or adhoc, but obviously not existing today. Which somewhat makes this whole discussion moot.

15

CachyOS, while it’s based on Arch, I don’t agree that it follows the same philosophies. Yes, user-friendliness isn’t an Arch philosophy, but CachyOS definitely takes a relatively friendlier philosophy, as seen with the respective aforementioned when it comes to making the experience that way. If people wanted something where user-friendless was out-of-scope, and assuming they don’t care for the other benefits of CachyOS, then they’d probably just install base Arch.

Additionally, by saying this:

Discussing and proposing those tools is how they eventually get developed. By considering these discussions moot, it prevents these tools from being developed in the first place.

16

Oh no, I didn’t say ‘don’t go develop that tool’. You read that in. I just said it doesn’t exist and thus can’t be currently implemented. However, I will grant that perhaps ‘moot’ is over-kill. Purely theoretical at this point then.
Just remember, the amount of what can be accomplished by the current dev team is strictly limited, and if my observation is valid, there is currently no one to take on this task.

17

Ah, alright! Sorry for the misinterpretation. You’re right, it is purely theoretical. That is a very fair point about how limited they are, and I do hope development can expand, which would make changes like these easier to fully implement.

18

No different than Windows so there will always be a bit of effort required by the user. While it is a bit buried, in application launcher just searching “firewall” gets you there and I can’t think of too many instances a typical user would need to have it front and center. UFW, at least on Cachy, defaults to allow all outgoing which covers almost all typical use cases. Looking around more even Ubuntu has that setup and is usually touted as “user-friendly”.

The best solution maybe would be KDE to expand their application presets as the only other one I can think of is similar to XP having a pop-up going “want to add this program to the rules?”. But the issue there is a classic cybersecurity problem: if you make things TOO easy (ie. that box basically everyone just clicked yes) then it defeats the purpose of it existing and back to the issue it was meant to solve.

19

All of that is a very fair point, but there’s still the issue that the failure is silent. Configuring the firewall isn’t that difficult, and I was mistaken to imply that it was, but in apps like KDE Connect, there is no way to actually tell if the firewall is causing it. When searching for your phone on your PC and vice versa, they simply don’t appear. There is no indication that anything is being blocked. As a result, the user doesn’t have much reason to search for anything to do with the firewall. Sure, you could say they should read documentation from sources such as the Arch Linux wiki, which do mention the firewall, but for an OS that aims for a streamlined user experience (“and a streamlined user experience”), that wouldn’t be very streamlined to have a built-in app (that functions normally on every other distro using the Plasma desktop environment), which is very commonly used by people, to just not work. Having a clear opt-in toggle section in something like the CachyOS Hello app wouldn’t bring us to that kind of cybersecurity problem, as it simply would just make it a little easier to discover a solution for a significant problem.

20

To be quite blunt, and I mean this in the most honest of ways, I feel as though a lot of the pushback against this is over-catastrophizing. I am simply proposing a minor UX change that would help make CachyOS more fluent in its use, and the pushback to that has been seemingly advocating for making the process harder. CachyOS does not have to follow a philosophy of things being manually set up in the terminal, and it is clear that it has taken the approach to making itself more user-friendly. Of course, it probably isn’t aiming (as of currently) to be as simple as distros like Linux Mint or Zorin OS, but it still appears to be going down that path to appease a significant userbase, which isn’t a bad thing. Many people who migrate to CachyOS are from Windows, and much of the fame that CachyOS has received was about how user-friendly and performant it is (which is also not unfounded, because this fame significantly stems from how CachyOS has OOTB setup apps). If people wanted a complex, manual setup distro, they would use base Arch Linux or something similar. Additionally, many people typically expect a built-in app to simply work, and if it doesn’t, at least tell them why its not working. There is a lot of unnecessary gatekeeping for a very simple change that would advance CachyOS further in its user-friendliness, and throughout this entire thread, there has been a lot of goalpost shifting. I’m not saying or implying CachyOS has to cater to the non-tech savvy granny, but rather, it already is trying to be more user-friendly, and this tiny solution would help significantly.