2

I am currently trying to configure ufw on Ubuntu 12.04 but to my understanding it behaves oddly. i tried allowing just some services on a remote machine, denying everything else. I thought - anyway, i might have gotten it wrong - that denying all by default and then allowing some services would serve my purpose, hence i emitted the following commands

ufw allow ssh
ufw default deny incoming
ufw default deny outgoing

To my understanding the last command would only block every connection i am trying to establish from the remote computer to some other computer, but it caused all connections i am trying to establish to the remote computer ending up being rejected. I am pretty sure that this command and not the deny incoming caused this behavior. To me this is quite counter-intuitive. I would suggest that, if I explicitly allowed ssh, i would be able to establish an connection to the remote machine, independent of the default settings. Even more it seems quite strange that blocking the outgoing connections breaks my ssh.

I would be very grateful if anyone could explain this to me.

1 Answer 1

2

Let's assume you have a SSH on your serverA on port 22. serverB tries to connect to it. It sends a packet from a random port within a net.ipv4.ip_local_port_range (3252 for example) to serverA 22 port. serverB:3252 -> ufw incoming allow 22 -> serverA:22

So on serverA connection gets allowed because incoming connections on 22 port are allowed, but but when your ssh server responses it sends a response packet from 22 port to serverB 3252 port and outgoing connections due to ufw default deny outgoing are blocked.

serverB:3252 <- ufw outgoing default deny <- serverA:22

So you have to add an allow rule in outgoing chain either for packets with source port 22 or with destination port within a local_port_range - usually 32768-61000 but may vary so better use source port base filtering.

4
  • I am afraid I did not get it. I now tried opening the outgoing connection with 'ufw allow from any port 22' (to port 22 was already enabled) but it did not change anything. When I enabled blocking by default it broke my ssh connection.
    – Paul K
    Oct 7, 2014 at 8:19
  • You need to add something like ufw allow out from yourIP port 22 proto tcp or ufw allow out to any port 32768:61000
    – Glueon
    Oct 7, 2014 at 9:20
  • Thank you very much. This ain't really uncomplicated. I would be glad if you could explain how to enable domain lookups. I tried to enable connections to port 53 and 42 (both in and out), but it did not work, unfortunately
    – Paul K
    Oct 7, 2014 at 9:36
  • If you need to allow outgoing DNS requests you need to do a reverse thing. DNS packets get blocked because you only allow incoming ssh connections and drop connections to any other port. So when the DNS reply comes back it gets dropped. You need allow a packet if it's a DNS reply (source port is 53) or allow all destination ports from a port range sysctl -a | grep port_range. Something like allow from any port 53 proto udp or allow from any to yourIP port 32768:61000 in incoming chain.
    – Glueon
    Oct 7, 2014 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .