This is how I setup my iptables with UFW:
sudo ufw default deny incoming(deny all incoming)
sudo ufw default deny outgoing(deny all outgoing)
sudo ufw allow out 53(accept outgoing DNS traffic, both tcp and udp)
sudo ufw allow in 80/tcp(accept all incoming tcp from port 80)
sudo ufw allow out 80/tcp(accept all outgoing tcp to port 80)
sudo ufw allow proto tcp from <admin_ip_addr> to <server_ip_addr> port 22(accept incoming tcp port 22 from administrator's office IP for ssh)
sudo ufw allow out 9418/tcp(accept outgoing git connections)
sudo ufw allow proto tcp from <server_ip_addr> to any port 22(accept outgoing ssh connections to connect with GitHub)
In English: block all, except for HTTP, DNS, incoming SSH from admin IPs, outgoing GIT and outgoing SSH.
Unfortunately, when I then do
git clone email@example.com:username/project.git it gets stuck at
Initialized empty Git repository in /home/adminuser/exper/project/.git/
When I then enable all outgoing traffic with
sudo ufw default allow outgoing, and repeat the git clone command, it does work.
So, apparently there is something outgoing that is still being blocked.
Can anyone tell me what this may be, and what rule I should add to allow it?
I have also tried the following rules, without success:
sudo ufw allow out 1024:65535/udp