Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is how I setup my iptables with UFW:

  1. sudo ufw default deny incoming (deny all incoming)
  2. sudo ufw default deny outgoing (deny all outgoing)
  3. sudo ufw allow out 53 (accept outgoing DNS traffic, both tcp and udp)
  4. sudo ufw allow in 80/tcp (accept all incoming tcp from port 80)
  5. sudo ufw allow out 80/tcp (accept all outgoing tcp to port 80)
  6. sudo ufw allow proto tcp from <admin_ip_addr> to <server_ip_addr> port 22 (accept incoming tcp port 22 from administrator's office IP for ssh)
  7. sudo ufw allow out 9418/tcp (accept outgoing git connections)
  8. sudo ufw allow proto tcp from <server_ip_addr> to any port 22 (accept outgoing ssh connections to connect with GitHub)

In English: block all, except for HTTP, DNS, incoming SSH from admin IPs, outgoing GIT and outgoing SSH.

Unfortunately, when I then do git clone it gets stuck at Initialized empty Git repository in /home/adminuser/exper/project/.git/

When I then enable all outgoing traffic with sudo ufw default allow outgoing, and repeat the git clone command, it does work.

So, apparently there is something outgoing that is still being blocked.

Can anyone tell me what this may be, and what rule I should add to allow it?

I have also tried the following rules, without success:

  1. sudo ufw allow out 1024:65535/udp
share|improve this question
up vote 3 down vote accepted

You're trying to connect with SSH, and that (appears to be) allowed, so it's time to diagnose the problem. I like to add a LOG rule just before I drop any packets, so I know exactly what's being dropped. Otherwise, a bit of tcpdump action should identify the traffic that's not going anywhere. Once you know what's being dropped, it's a trivial matter to add the necessary rules to allow it.

share|improve this answer
The thing is that all my rules allow packets, the default is drop. But I can probably find the drop in syslog. I will report back if I have more details. – Tom Mar 18 '12 at 9:33
Then you make a LOG rule the last in the chain. – womble Mar 18 '12 at 9:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.