Questions tagged [ufw]
Uncomplicated Firewall is a firewall configuration tool for Linux. It acts as a frontend to iptables. Originally designed for Ubuntu, it is available on many Linux distributions.
487
questions
0
votes
1
answer
1k
views
Iptables rules for UFW
I need the following rules implemented in UFW but don't know how to do this exactly:
iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE
#Note: If you use tcp protocol you must change -...
- 143
0
votes
1
answer
3k
views
ufw route allow in on wg0 out on wg0 to 10.0.0.6/32
I use a WireGuard VPM to reversely connect to my home server via an external entry node. On that entry node, I try to add a firewall rule using ufw. Its purpose is to only allow routing to one and ...
- 69
2
votes
1
answer
3k
views
How to route openvpn traffic through a second network adapter, to access the internet
I am running an ubuntu server with two network adapters eth0 and usb0, both with separate internet connections.
The openvpn server is listening on eth0, and client can connect to the vpn using the ...
- 21
1
vote
2
answers
1k
views
Open UFW port to specific IP with Ansible
I ran the following task copied right from the Ansible 2.9 docs:
- name: Allow all access from RFC1918 networks to this host
ufw:
rule: allow
src: '{{ item }}'
loop:
- 10.0.0.0/8
- ...
- 133
0
votes
1
answer
67
views
Is it Safe to Use "ufw allow from xx.xx.xx.xx" Command for IP Addresses Which are Faced With UFW_BLOCK?
I have UFW opened on my database servers and I have seen a lot of UFW_BLOCK logs. Is it safe or right to use "ufw allow from xx.xx.xx.xx" and "ufw allow to xx.xx.xx.xx" command for ...
1
vote
1
answer
1k
views
What runlevel should ufw firewall start at in Alpine Linux?
I am using ufw on Alpine linux.
I have configured it in a pretty standard way:
apk add --no-cache ufw
ufw allow ssh
ufw allow http
ufw allow https
ufw limit ssh
ufw enable
rc-update add ufw default
...
0
votes
0
answers
63
views
Why are these packages removed when installing ufw on Debian 6?
I have a very old legacy server running Debian 6.0.10, from which I'm gradually moving things to Debian 10 on a fresh server. There haven't been any real issues, although I'm well aware there may be ...
- 201
2
votes
1
answer
1k
views
How to do client to client routing rules with UFW?
I would like to use UFW to control client to client access rules for a wireguard network. And I would like to do this on a central hub server. But I can't quite figure it out. Right now it works but ...
- 241
0
votes
0
answers
209
views
Unable to port-forward with firewall
I am trying to create a simple gateway with ubuntu that performs the functions of nat, firewall, and forwarding.
With the firewall disabled I can connect to a web server located in a subnet that I ...
2
votes
2
answers
749
views
DNAT to another hidden port on same host
I am hoping to use iptables to silently redirect incoming traffic arriving at a privileged port on the public eth interface (public IPv4 address) to a hidden unprivileged port on the same ubuntu box. ...
- 41
0
votes
1
answer
592
views
maximizing security on gunicorn system
I have 2 machines running ubuntu server, one as a proxy running nginx and another machine as a app server running gunicorn. Lets name the nginx machine server 1 and the gunicorn server 2.
Everything ...
1
vote
1
answer
3k
views
Port 25 won't open on Digital Ocean droplet [duplicate]
I’m trying to set up an email server. I can’t seem to get port 25 to open for me. I literally just did:
ufw disable
ufw reset
ufw default deny incoming
ufw default allow outgoing
sudo ufw allow 22/...
- 63
3
votes
1
answer
3k
views
ping returns IPV6 address on ubuntu 20.04
I have installed GitLab on a cloud VM and shortly after stood up a second VM as a postfix server with the same provider (Hetzner)
I first noticed a problem when I went back to the GitLab server to ...
- 235
0
votes
1
answer
651
views
UFW Weird ICMP log record - Pinging is blocked
In the log records below I have replace my eth MAC address with ETH_MAC_ADDRESS the IP of my server with MY_SERVER_IP and other IPs with STRANGE_IP plus a number to distingue.
Jan 29 15:11:48 cld ...
- 123
2
votes
0
answers
62
views
ufw rule not reflected in firewalld
I have allowed connection from anywhere to anyport using ufw:
sudo ufw allow from any
When I try to reach a service I still get blocked, I receive No route to host but if i disable firewalld then I ...
- 139
0
votes
0
answers
301
views
Subnets in Server OpenVPN
I have set up an openvpn server according to my needs: I need to have 256 subnets and for each subnet I need 256 users, so I thought about creating a server of type 10.8.0.0/16. The server runs on ...
- 101
0
votes
2
answers
2k
views
ufw blocking certain traffic on web server that ought to be allowed
In an Ubuntu 16.04 machine hosting an internet-facing web application, my /var/log/syslog is being flooded by messages of the sort:
Jan 9 17:41:50 ip-172-31-11-100 kernel: [483324.699896] [UFW BLOCK] ...
- 2,565
1
vote
0
answers
4k
views
Unable to access apache from port 80, likely due to firewall configuration
Background: My company hosts two server instances for our internal web-based systems dashboard: a development server and a production server. For added security on the production server, we usually ...
- 111
2
votes
1
answer
8k
views
How to allow all traffic on a local interface using UFW?
I've got Apache running as a reverse proxy for another Docker service. I got it working but as soon as I enable UFW, all connections are blocked with this error message:
Dec 29 23:50:23 vps520941 ...
- 189
1
vote
1
answer
2k
views
ip6tables-restore on Debian upgrade: `RULE_APPEND failed (Invalid argument)`
On running the command
ip6tables-restore < /etc/iptables/rules.v6
on the Debian server, I get
ip6tables-restore v1.8.2 (nf_tables):
line 48: RULE_APPEND failed (Invalid argument): rule in chain ...
- 121
0
votes
1
answer
5k
views
ufw enable port 3306 for mysql access, but can not ping
above are my ufw status
but if I ping 3306 at
https://ping.eu/port-chk/
it reports the port is closed
your comment welcome
- 135
0
votes
1
answer
1k
views
Can not ping any hostname/domain when ufw enabled
Why I can't ping any domain/hostname when ufw enabled?
[root@ip-172-31-23-37 ec2-user]# ping google.com
ping: google.com: Name or service not known
[root@ip-172-31-23-37 ec2-user]# ufw disable
...
0
votes
1
answer
2k
views
Cannot connect to port 5432 locally even though it is allowed by UFW
I'm trying to setup my server so that port 5432 (Postgres) is accessible only from localhost. So I've denied everything, and added back port 5432, however I cannot connect to it.
Here is my UFW config:...
- 189
3
votes
1
answer
1k
views
ufw deny from ip doesn't work
I know that I should setup fail2ban but at the moment I want to deny access from one IP address and tried the following ufw command:
sudo ufw insert 1 deny from xx.xx.xx.xx to any
Here's the output ...
1
vote
0
answers
27
views
Ubuntu 18.04 UFW setup
I have one application running on two ports HTTP on 8080 and HTTPS on 8443.
I want everyone to have access to port 8443 and whitelist 8080 to an IP, so only a particular IP can access the port.
So I ...
- 19
3
votes
1
answer
1k
views
Can I use rate-limiting with HTTP basic authentication in Apache?
So I'm running a few popular web applications on my server. I want these to be reachable from any computer without creating too many vulnerabilities.
I am using Apache 2.4.29 as my HTTP server. My ...
- 33
0
votes
1
answer
1k
views
How to only allow routing to IP range on particular interface?
I have two interfaces eth0 (192.168.10.x) and wlan0 (172.16.30.x) on my device (Raspberry Pi, Raspbian GNU/Linux 10 (buster)).
Both networks have access to the internet, but I want my device to only ...
- 3
1
vote
0
answers
93
views
UFW - making rules on host to only allow traffic from guest docker containers?
Situation:
host running pgsql
app in container on host
want app to connect to database via TCP
want to configure UFW so only containers on machine can connect to pgsql
What's the best way to do this?...
- 215
1
vote
2
answers
861
views
IPv4 Forwarding (NAT) only works after toggling IPv4 forwarding to off then on
This literally makes no sense and I'm stumped about why this is happening, but hear me out.
Currently I'm using Proxmox 6 (Debian) and I created a NAT so VMs/LXC containers can communicate between ...
- 121
2
votes
0
answers
920
views
UFW denying on interfaces blocks traffic on all interfaces
So I have a bit of a weird issue with ufw, I'm trying to block all incoming traffic on eno1 and use eno2 for incoming traffic instead, to do this I've ran the following commands to try to block eno1 ...
- 21
2
votes
1
answer
3k
views
How do I limit simultaneous connections to a port with UFW?
I see many articles regarding brute attacks, number of connections per N seconds, but in my case is different, i have a proxy server and i just want to limit connections from anywhere to 1 at the time....
- 29
0
votes
1
answer
112
views
Why UFW port range / number for ports is limited to 15 ports? [closed]
Why UFW port range / number of ports is limited to 15 ports?
man ufw:
You cannot specify more than 15 ports
- 117
0
votes
1
answer
661
views
I ufw deny 53, but an nc scan reports a successful connection
Why is an nc scan able to successfully connect with port 53 when I've denied it through ufw?
I noticed port 53 is listening:
$ sudo ss -tulpne
Netid State Recv-Q Send-Q Local Address:Port Peer ...
0
votes
2
answers
475
views
Why use a hardware firewall?
This question is rather conceptual and I just need some clarifications.
Let's say on your linux server you've something like ufw installed or windows firewall on windows server. And you have layers ...
- 297
0
votes
0
answers
303
views
How traffic flow to docker published port without iptables?
I wanted docker to respect ufw rules, so found this topic https://stackoverflow.com/questions/30383845/what-is-the-best-practice-of-docker-ufw-under-ubuntu
I did the following:
set "iptables&...
- 193
2
votes
1
answer
2k
views
UFW blocks Docker interfaces when default outgoing policy is 'deny'
Given that I configured UFW like so
ufw default deny incoming
ufw default deny outgoing
and just allowed certain ports for outgoing and incoming connections. It works fine, except when connecting ...
- 21
0
votes
2
answers
291
views
Why use ufw if the ports are closed by default
My question is why use a firewall like ufw if most of the ports are closed by default and the open ones are mean to be accessed.
- 297
1
vote
1
answer
7k
views
Recommended UFW settings for mailserver with postfix/dovecot
I am setting up a simple server to serve up websites and also serve as a mailserver all together. The mail service will be small just used by me to administer mail for my personal sites and I'm just ...
- 135
2
votes
1
answer
1k
views
Why ufw deny(incoming) still allowes connections
I have enabled ufw. The is ufw status verbose output
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action ...
- 193
1
vote
0
answers
27
views
Shouldn't UFW configured Iptables deny access before the request reaches our Unbutu 16.04 hosted Nginx server?
We are using ufw to configure iptables.
We have numerous rules denying access from ip addresses that use bots. Here is one example:
sudo ufw deny from 0.1.0.0/0.1.255.255
These bots are attempting to ...
- 191
0
votes
1
answer
5k
views
IPTables source NAT (SNAT) to /etc/ufw/before.rules
I have a need to source NAT (SNAT) traffic between two interfaces in an Ubuntu 18.04 server. I've been trying to use the '/etc/ufw/before.rules' file to implement my various NAT needs and so far so ...
- 3
1
vote
1
answer
173
views
KVM with Public IP on Ubuntu 16.04 with NIC subinterfaces/aliases
I want to connect to VM1 (192.168.122.101) from/to the internet, i.e., Internet (x.x.5.5/ens3:4) <-> VM1 (192.168.122.101) without impacting the other networks (ens3, ens3:0->3).
The problem ...
- 131
0
votes
1
answer
928
views
Deny connections from IPv6 (Debian Buster)
Inexplicably, it seems like there has been a bug for a long time in one of the most widely used firewalls, UFW, which does not allow for adding IPv6 deny rules above any other IPv4 rules.
The result ...
- 1
1
vote
2
answers
4k
views
UFW firewall rules for transmission-daemon on ubuntu 20.XX
I have got transmission running on ubuntu 20.XX VPS and i can log into the web interface with MYIP:9091/ to manage the files.
I am using ufw firewall. I have added these rules to allow the following ...
0
votes
1
answer
3k
views
How to setup fail2ban with ufw to block IPv6?
Since fail2ban Version 0.10 IPv6 is supported. I used fail2ban in conjunction with ufw. I found that only IPv4 addresses are blocked. This is unfavorable.
Failed to execute ban jail 'nginx-noscript' ...
- 705
0
votes
2
answers
2k
views
Unable to connect to port 8000 on Azure
Description
I am using a virtual machine with the Ubuntu image. I tried to run my server on Django with this command
python manage.py runserver 0.0.0.0:8000.
When I search <public ip>:8000 it ...
1
vote
1
answer
1k
views
Outbound port 25 cannot telnet
Hopefully this isn't just another "Port 25 blocked" question. My situation is slightly different.
I have 2 accounts with hosting company X.
Account 1: Ubuntu box can telnet to given.domain....
- 149
-1
votes
1
answer
2k
views
How do I open a port on one IP only with UFW?
I have seven IPs on my server. Using UFW, if I enter the rule 'ufw allow 7443', port 7443 is exposed and opened on all my IPs. But I only want port 7443 to be exposed on one particular IP address and ...
- 1
0
votes
0
answers
91
views
Avoid adding new UFW after docker restart
I'm hosting a web application on my server and want to it to be reachable only from a few specific IPs. UFW/iptables sounds like a good choice here.
After reading The dangers of UFW + Docker I've ...
- 101
1
vote
1
answer
892
views
Getting Monit Web Interface and CLI to work on Ubuntu server
I have a hard time getting monit to work on my Ubuntu 18.04.4.
I've installed monit via sudo apt install monit, then I've enabled httpd like this:
set httpd port 2812 and
use address localhost
...
- 111