# UFW with Umbrel? **URL:** \ **Category:** General Discussion\ **Created:** [September 19, 2021, 3:51pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525 "2021-09-19T15:51:14Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![socrates](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@socrates](https://community.umbrel.com/u/socrates)\ **Post date:** [September 19, 2021, 3:51pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/1 "2021-09-19T15:51:15Z")
Any tips on hardening Umbrel’s PI security? Can I use UFW and if so what ports does Umbrel need open? Fail2ban? My umbrel is behind a router in a LAN with no ports open on the router to it; nevertheless I am in the habit of hardening pi’s whenever I use them. ---
**Author:** ![DarthCoin](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/darthcoin/32/1628_2.png) [@DarthCoin](https://community.umbrel.com/u/DarthCoin)\ **Post date:** [September 19, 2021, 4:11pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/2 "2021-09-19T16:11:15Z")
None of those are necessary for Umbrel. All traffic is behind Tor, so no ports need to be open in your router/machine. Tor is using onion addresses for each Umbrel app (like being a port) without need of any port. Only in special cases if you really want to use reverse proxy Tor-to-clearnet, will be necessary more changes, but those are mostly for BTCpay, LNbits and are guides dedicated to that. But for normal use as a BTC/LN node is enough and you can connect all your mobile apps using Tor onion address. ---
**Author:** ![socrates](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@socrates](https://community.umbrel.com/u/socrates)\ **Post date:** [September 19, 2021, 5:23pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/3 "2021-09-19T17:23:03Z")
Thanks for reply and it is understood that using onion addresses requires no open ports on router, but what about on node/pi. While UFW may not be necessary for Umbrel while using the onion addresses, if I have some other apps running where UFW would be helpful for security, I just wanted to make sure that by using UFW, I wouldn’t accidently prevent umbrel from working. So, the question is: would blocking ports via UFW on my umbrel node (not on the router) in any way hinder umbrel from working? ---
**Author:** ![DarthCoin](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/darthcoin/32/1628_2.png) [@DarthCoin](https://community.umbrel.com/u/DarthCoin)\ **Post date:** [September 19, 2021, 5:25pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/4 "2021-09-19T17:25:49Z")
the simple answer is NO. You can play with UFW as much as you like and if you know what are you doing. Just in case, to not use some of the other apps ports from Umbrel, open your Umbrel from local IP and open the apps, one by one. You will see for each which port they are using. So note those ports NOT to be used for other of your apps you install on that machine and NOT to be open in UFW (only if you really want it). Actually you just gave me an idea to add to my Umbrel guides a list of all ports used. ---
**Author:** ![socrates](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@socrates](https://community.umbrel.com/u/socrates)\ **Post date:** [September 19, 2021, 5:27pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/5 "2021-09-19T17:27:45Z")
Thanks. A list of all ports used by Umbrel would be perfect for helping us avoid any conflicts with other apps. ---
**Author:** ![DarthCoin](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/darthcoin/32/1628_2.png) [@DarthCoin](https://community.umbrel.com/u/DarthCoin)\ **Post date:** [September 19, 2021, 5:30pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/6 "2021-09-19T17:30:02Z")
Yes, I am planning to extend [this getting started guide for Umbrel](https://telegra.ph/Umbrel-Node---Simple-management-guide-03-09) to a larger manual. I will add there the ports for apps. ---
**Author:** ![socrates](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@socrates](https://community.umbrel.com/u/socrates)\ **Post date:** [September 21, 2021, 9:32pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/7 "2021-09-21T21:32:27Z")
@DarthCoin One more request if possible for your “getting started guide”. I am wondering about the best ways to share my umbrel node with family and friends. I am aware of Spectre Desktop which allows me to create other user accounts for cold/hardware wallets. But my question is regarding on chain hot wallets (not the Lightning wallets). Can I allow friends to use the Wallet connect info for a specific wallet to use my node for checking for on chain transactions? Is it a security risk or could it cause confusion for my transaction records? I am assuming hot wallets are just connecting to the umbrel node to watch for transactions and confirmations, but are not saving info on the umbrel node. Is this correct for all those wallets available in the connect wallet area? ---
**Author:** ![DarthCoin](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/darthcoin/32/1628_2.png) [@DarthCoin](https://community.umbrel.com/u/DarthCoin)\ **Post date:** [September 21, 2021, 10:40pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/8 "2021-09-21T22:40:29Z")
Here you have another 2 guides that you can use: > [@Umbrel + BlueWallet + LNDHub](http://community.umbrel.com/t/umbrel-bluewallet-lndhub/497): > > Description This is a major step forward for all node operators. Why? Because is one more step for a node in becoming a “Bitcoin Sovereign Bank”, being a HUB for your family, friends and all those who do not/can’t have a node for themselves. Practically you can “rent” them space and liquidity from your node. More details about [LNDhub here](https://bluewallet.io/lndhub/) and also here is [the announcement from Bluewallet team](https://bluewallet.io/BlueWallet-brings-zero-configuration-Lightning-payments-to-iOS-and-Android-30137a69f071/). There’s a very important aspect in Bitcoin world and few understand it: custodial wallets (your fun… and > [@Umbrel LNBits app - Description and basic use](http://community.umbrel.com/t/umbrel-lnbits-app-description-and-basic-use/70): > > LNURL + LN node + LNDHUB + NFC + merchant support = anyone with sats and a LN channel being able to self issue their own “debit card” against their own “checking account.” Description LNBits it’s an amazing app that is adding a suite of features to Umbrel node and users can adapt to their needs. This app is using the node liquidity (onchain and LN) and is adding a separate database for management. You can use it for multiple wallets, as a LNDhub or specific usage for merchants, content creato… ---
**Author:** ![gkucmierz](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/gkucmierz/32/1089_2.png) [@gkucmierz](https://community.umbrel.com/u/gkucmierz)\ **Post date:** [May 17, 2022, 6:23pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/9 "2022-05-17T18:23:44Z")
It is easy to check with `nmap` which ports are open by default. ```auto nmap umbrel.local Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-17 20:19 CEST Nmap scan report for umbrel.local (192.168.21.3) Host is up (0.0020s latency). Other addresses for umbrel.local (not scanned): ::f14f:5bae:c04f:3d2b Not shown: 991 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3000/tcp open ppp 3006/tcp open deslogind 8000/tcp open http-alt 8080/tcp open http-proxy 8333/tcp open bitcoin 10009/tcp open swdtp-sv 50001/tcp open unknown ``` ---
**Author:** ![thin-dark-menu](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@thin-dark-menu](https://community.umbrel.com/u/thin-dark-menu)\ **Post date:** [April 4, 2023, 8:15pm UTC](https://community.umbrel.com/t/ufw-with-umbrel/3525/10 "2023-04-04T20:15:56Z")
This is exactly the reason for using ufw (or any other firewall) on umbrel! The node may be behind a NAT, but there are multiple insecure devices inside the local network which could pose a threat to the system security. So many IoT devices are in everybody’s home network running on obsolete software. Those devices could very easily be used for brute-force attacking umbrel if it is not firewalled properly. In my opinion the best way is to close all ports to all IP addresses except the one is used for administration. Also, the dhcp / router device must reserve IP addresses by MAC address.