Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed ufw on my Debian system like the following:

# aptitude install ufw
# ufw limit 22
# ufw allow 80
# ufw allow 443
# ufw enable
# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
20                         LIMIT       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere

A simple ping google.com fails, also any aptitude install will fail. I searched serverfault for answers. One solution was to allow port 53 for DNS - didn't help. Or ufw allow out 1024:65535/udp together with port 53 - didn't help.

What worked was to allow my DNS server like ufw allow from [DNS IP]; but that's no solution if you ask me.

apt-get and aptitude are all blocked by ufw. Couldn't find anything on how to allow installing new things. A ufw log entry example:

Aug 12 17:31:08 host kernel: [535454.665168] [UFW BLOCK] IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=41343 WINDOW=14480 RES=0x00 ACK SYN URGP=0

Any ideas?

share|improve this question
Is it voted down because the person who voted my question down doesn't know the answer? –  Fleshgrinder Aug 12 '12 at 17:28
I'd look for something like this, since it just interfaces with iptables: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT –  nojak Aug 18 '12 at 1:28
Thanks @nojak I will give this a try. :) –  Fleshgrinder Aug 18 '12 at 9:57
@nojak Post it as an answer and I accept it as the correct one. This works like a charm! –  Fleshgrinder Aug 22 '12 at 14:17
Glad to hear it! –  nojak Aug 23 '12 at 7:26

2 Answers 2

up vote 4 down vote accepted

You need to add the following into iptables, as ufw just interfaces with it.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

share|improve this answer
This is the first answer after hours of searching to fix the issue. Thanks. –  Razick Feb 21 at 21:20

What worked for me, using Ubuntu here (14.04 and 14.10 at the time of this writing), comes from the following article: http://rene.bz/securing-your-web-server-blocking-outbound-connections/

iptables -A ufw-before-output -m owner --uid-owner root -p tcp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A ufw-before-output -m owner --uid-owner root -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

It might not be an ideal solution. But it does enable me to authorize apt commands on a per-user basis.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.