5

I have the same Problem as described here, but the given solution doesnt work for me:

ufw blocking apt and dns

When I add the rule ufw deny out to any, and add the port 80, 443/tcp, ssh-port as exceptions, and then add iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I still am not able to use apt-get update, or similar things.

root@iof304:~# ufw status Status: active

To                         Action      From
--                         ------      ----
22                         DENY        Anywhere
80                         ALLOW       Anywhere
(ssh)                      LIMIT       Anywhere
22                         DENY        Anywhere (v6)
80                         ALLOW       Anywhere (v6)
(ssh)                      ALLOW       Anywhere (v6)

(ssh)                      ALLOW OUT   Anywhere
Anywhere                   DENY OUT    Anywhere
80                         ALLOW OUT   Anywhere
443/tcp                    ALLOW OUT   Anywhere
(ssh)                      ALLOW OUT   Anywhere (v6)
Anywhere (v6)              DENY OUT    Anywhere (v6)
80                         ALLOW OUT   Anywhere (v6)
443/tcp                    ALLOW OUT   Anywhere (v6)

Now, I'll delete the ufw deny out to any (with that, everything works fine) but I'ld like to restrict everything as good as possible, so what I probably would need to know, are the ports used for apt-get - they have to be OUT ports, since only deny out to any blocks everything, but apt-get doesnt seem to have a problem downloading stuff with that rule disabled (is that a sign that the other IN ports arent blocked?)

Thanks in advance

6 Answers 6

7

These rules helped me to successfully get rate limiting on SSH, allow in/out http and https, enable git, and have apt and aptitude working no problem:

ufw default deny incoming
ufw default deny outgoing
ufw limit ssh
ufw allow svn
ufw allow git
ufw allow out http
ufw allow in http 
ufw allow out https
ufw allow in https
ufw allow out 53
ufw logging on
ufw enable

Note: I did initiate these rules with a ufw reset in order to start fresh.

3

I've found the answer:

Port 53 needs to be opened, for DNS

Port 123 seems to be a good idea too

Port reference: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

1

from ufw man page

Rule ordering is important and the first match wins. Therefore when adding rules, add the more specific rules first with more general rules later.

from the output you've posted looks like you're deny all is getting caught before you're allow rules

2
  • Tried to switch them around (deleted 'deny out any' and added it aggain) now it appears at the end, but aptitude update still gets blocked
    – Katai
    Jan 15, 2013 at 9:19
  • Just want to add that this is a really important point when setting up the rules logged into a server remotely. Saved my bacon.
    – MER
    Sep 12, 2016 at 21:22
0

So, just in case it helps someone I have a finalized list of my ufw commands for a server that is intended to be a web server that connects to a back end storage solution mounted with fuse, (the fuse implementation communicates to the storage service over http).

Method
I fairly exhaustively went through the list of standard ports (not completely exhaustively just fairly... so I likely added more than are needed and probably missed a few).
I utilized /etc/server as well as the wikipedia list of ports and various other articles led me there...

List
Anyway here are the commands in order:

ufw default deny incoming
ufw default deny outgoing
ufw limit 22/tcp
ufw allow 9418/tcp
ufw limit <your custom SSH port here if not 22>/tcp
ufw allow 80
ufw allow 443
ufw allow out 80
ufw allow out 443
ufw allow out 53
ufw allow out 37
ufw allow out 101
ufw allow out 161
ufw allow out 135
ufw allow out 427
ufw allow out 43
ufw allow out 115
ufw allow out 525
ufw allow out 123
ufw allow out 873
ufw allow out 989
ufw allow out 990
ufw allow out 530
ufw allow out 546
ufw allow out 547
ufw allow out 593
ufw enable


Justification
In the way of a bit of explanation, Apache = port 80, Apache Secure = 443, (and had to put it in quotes for the command to go through).
Port 9418 is for git (though it can use various protocols), 530 & 546 are IPV6, 530 & 593 are both rpc related.
Also SSH doesn't go over UDP (thus the /tcp on the second command).
Again hope that helps someone.

UPDATE:
The above previously did NOT fully allow apt-get to work (I thought it did but when I went to do apt-get update I was getting odd results were the progress seemed to get stuck).
Anyway I also failed to notice this line from the man page:

ufw supports both ingress and egress filtering and users may optionally specify a direction of either in or out for either incoming or outgoing traffic. If no direction is supplied, the rule applies to incoming traffic. ...

(emphasis added by me, cause, well it needs it).
Turns out, along with the DNS port (53) you have to have outgoing HTTP/HTTPS ports enabled in order to have apt-get function properly (makes sense... and wget will surely appreciate this too & any webservices, & probably many get repositories, etc...).



Other Resources
https://stackoverflow.com/questions/323351/does-http-use-udp https://www.linux.com/learn/introduction-uncomplicated-firewall-ufw https://ubuntuforums.org/showthread.php?t=1876124

0

This works for me (Ubuntu 20.04):

ufw allow 80/tcp
ufw allow 443/tcp 
ufw allow 53/udp
ufw allow out 80/tcp
ufw allow out 443/tcp 
ufw allow out 53/udp
0

This issue has been driving me mad for days, ended up resolving it by just completely uninstalling ufw and cleaning up any leftover resources and then doing a clean install again with the same port rules.

First disable ufw:

sudo ufw disable

Remove the package:

sudo apt-get remove ufw

Purge previous ufw configuration files:

sudo apt-get purge ufw

Remove unusued packages and clean the local repository:

sudo apt-get autoremove
sudo apt-get clean

Re-install ufw again and set up the rules again to your liking:

sudo apt install ufw

I have no idea what caused the initial install and set up to break, didn't change anything at all.. strange.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .