Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed ufw on my Debian system like the following:

# aptitude install ufw
# ufw limit 22
# ufw allow 80
# ufw allow 443
# ufw enable
# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
20                         LIMIT       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere

A simple ping fails, also any aptitude install will fail. I searched serverfault for answers. One solution was to allow port 53 for DNS - didn't help. Or ufw allow out 1024:65535/udp together with port 53 - didn't help.

What worked was to allow my DNS server like ufw allow from [DNS IP]; but that's no solution if you ask me.

apt-get and aptitude are all blocked by ufw. Couldn't find anything on how to allow installing new things. A ufw log entry example:

Aug 12 17:31:08 host kernel: [535454.665168] [UFW BLOCK] IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=41343 WINDOW=14480 RES=0x00 ACK SYN URGP=0

Any ideas?

share|improve this question
Is it voted down because the person who voted my question down doesn't know the answer? – Fleshgrinder Aug 12 '12 at 17:28
I'd look for something like this, since it just interfaces with iptables: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT – nojak Aug 18 '12 at 1:28
Thanks @nojak I will give this a try. :) – Fleshgrinder Aug 18 '12 at 9:57
@nojak Post it as an answer and I accept it as the correct one. This works like a charm! – Fleshgrinder Aug 22 '12 at 14:17
Glad to hear it! – nojak Aug 23 '12 at 7:26
up vote 5 down vote accepted

You need to add the following into iptables, as ufw just interfaces with it.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

share|improve this answer
This is the first answer after hours of searching to fix the issue. Thanks. – Razick Feb 21 '14 at 21:20

What worked for me, using Ubuntu here (14.04 and 14.10 at the time of this writing), comes from the following article:

iptables -A ufw-before-output -m owner --uid-owner root -p tcp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A ufw-before-output -m owner --uid-owner root -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

It might not be an ideal solution. But it does enable me to authorize apt commands on a per-user basis.

share|improve this answer

I had an issue with pptpd + ufw - requests to DNS were blocked even if I allow 53 port. Have you tried to open /etc/default/ufw and change the option "DEFAULT_FORWARD_POLICY" from "DROP" to "ACCEPT"? It did the trick for me.

share|improve this answer

These rules helped me to successfully get rate limiting on SSH, allow in/out http and https, enable git, and have apt and aptitude working no problem:

ufw default deny incoming
ufw default deny outgoing
ufw limit ssh
ufw allow svn
ufw allow git
ufw allow out http
ufw allow in http 
ufw allow out https
ufw allow in https
ufw allow out 53
ufw logging on
ufw enable

Note: I did initiate these rules with a ufw reset FIRST in order to start fresh.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.