Ubuntu Linux for Robotics · Lesson 28 of 96

Firewall and multicast configuration

ufw rules for DDS ports, multicast on Wi-Fi and checking that packets flow.

Estimated time · 45–75 min

Learning goals

What you will understand

Explain firewall and multicast configuration in your own words
Use it in a small workstation example
Verify the result instead of assuming it worked

Understand the idea first

The mental model

Ubuntu's firewall front end is ufw. When it is enabled it blocks incoming UDP by default, which stops DDS discovery and data. DDS uses UDP port 7400 + 250 × domain for discovery, plus ports for user data starting near 7410; allow the UDP range for your domain from the robot network only, not from everywhere.

Wi-Fi access points often drop or rate-limit multicast, and some routers block it between clients. Wired Ethernet is more reliable. If multicast is unavailable use a unicast setup such as a discovery server (Fast DDS) or peer lists (Cyclone DDS). Always allow SSH before enabling ufw on a remote machine.

Guided lesson

Work through these steps

1.
Open a terminal and record the current state before changing anything.
2.
Read the firewall and multicast configuration commands and predict what each one does.
3.
Run the commands one at a time and compare each output with your prediction.
4.
Write the commands that worked in a setup note you can repeat later.

Worked example

Read it before you run it

sudo ufw status verbose
# Show whether the firewall is on and its rules.
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
# Allow SSH from the robot network first, so you cannot lock yourself out.
sudo ufw allow from 192.168.1.0/24 to any port 7400:7500 proto udp
# Allow DDS traffic (domain 0) from the robot network.
sudo ufw enable
# Turn the firewall on.
sudo ufw status numbered
# List rules with numbers so you can delete one.
sudo tcpdump -i eth0 -n udp portrange 7400-7500 -c 5
# Verify that DDS packets arrive.

What the example is doing

1.Lines without sudo only inspect or change files you own; sudo authorizes a system-wide change.
2.Read command output before moving to the next line. Stop if names, versions, disks, or paths differ from the lesson.
3.Comments beginning with # explain safety checks and are not executed by the shell.

Watch it run · Messages between nodes

See what this code does

The terminal types this lesson's practice solution and runs it. The scene shows the kind of robot behaviour that code drives. It plays by itself and loops.

Practice code

Now type it yourself

Open a terminal, run the starter line by line (or save it as practice.sh and run bash practice.sh), and replace every TODO with your own command.

sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
# TODO: allow UDP ports 7400 to 7500 from the network 192.168.1.0/24
sudo ufw status

Expected output

7400:7500/udp ALLOW 192.168.1.0/24

Stuck? Show the full solution (try it yourself first)

sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
sudo ufw allow from 192.168.1.0/24 to any port 7400:7500 proto udp
sudo ufw status

Expected result

How you know it worked

Each command completes without an unexplained error.
Your notes contain the command, the important output, and what it proves.

Practical exercise

Apply the lesson

Enable ufw with only SSH allowed and confirm ROS 2 nodes on two machines stop seeing each other; then add the DDS rule for your network and confirm they reconnect. Record the rule you added.

Before you continue

You recorded the starting state
Every command and output is understood
The change can be repeated from your notes

If something goes wrong

A command says permission denied.

Check ownership and permissions first. Do not add sudo unless the command changes a documented system location.

A command or package is not found.

Check spelling, Ubuntu version, enabled repositories, and whether the previous installation command succeeded.