I'm new to UFW. One of our servers were compromised and I had to immediately:

  • Deny all inbound.
  • Deny all outbound.
  • Allow all SSH.
  • Allow outbound DNS.
  • Allow Git clone, push, pull, etc.
  • Allow only inbound HTTP/S (80 & 8081, 443). Outbound HTTP/S that originate from the server should be blocked.
  • Allow MySQL to only connect to or localhost and block all incoming MySQL.

I realize some of those rules are strange but this is what I was asked to do. I realized I'm actually not sure how to do some of them in UFW.

Here's what I have:

# Deny all outgoing.
ufw default deny incoming

# Deny all outgoing.
ufw default deny outgoing

# Allow outgoing DNS.
ufw allow out 53

# Allow SSH.
ufw allow 22

# Allow outbound Git (I need to be able to clone, pull, push, etc).
ufw allow out 9418/tcp

# Allow only incoming HTTP on port 80 and 8081 without outbound.
# Allow only incoming HTTPS on port 443 without outbound.
ufw allow in to any port 80 proto tcp

# Allow MySQL to connect to localhost only.
ufw allow from to port 3306 proto tcp

After I run the above, I can:

  1. use curl --request GET 'http://foo.bar' to send an HTTP request to another site. I need to deny HTTP requests that originate from within the server.
  2. NOT clone with Git. It just hangs.

I haven't tested MySQL yet but it shouldn't be allowed to connect to anything but and localhost.

What do I need to change to have it behave the way I want it to?

1 Answer 1


You need to allow incoming on the ports you opened, not just outgoing. Otherwise the destination server will not be able to send you a response. If you notice, your ssh works because you're allowing incoming and outgoing. GIT does not work because you're blocking the response from the remote server. DNS is probably broken as well.

MySQL: by default your my.cnf should not allow remote connections; you usually have to explicitly allow it in the bind-address.

  • +1 for the my.cnf suggestion. That's what I should have done. I want to block outgoing HTTP requests that originate from within the server. We suspect that some sites have been compromised and are sending out HTTP requests. How can I stop those? I'll edit my question to specify that they originate from the server. Also, how can I modify my rules to allow Git?
    – Housni
    Commented Jan 29, 2016 at 18:54
  • I don't have a Linux box in front of me, but try changing your GIT rule to "ufw allow 9418/tcp". Should allow incoming and outgoing. You should be blocking outgoing http requests already with your default outgoing rule (no other rule matches the port so default should apply).
    – vik
    Commented Jan 29, 2016 at 18:57
  • I'm not sure why you'd want to allow incoming requests to http on the server but block outgoing; you might as well just block port 80 completely as you won't get a response from the server.
    – vik
    Commented Jan 29, 2016 at 19:03
  • I believe the correct syntax is ufw allow proto tcp from any to any port 9418 but that didn't solve the problem. I also set ufw allow 53 but now I get a ssh: Could not resolve hostname github.com: Temporary failure in name resolution when I try to clone. Oh, I don't want to block responses, I only want to block connections that originate from the server. Maybe I was explaining it wrong....so, cURL shouldn't be able to send a GET request to Google.com but Google should get a response from my server, if Google sent a request.
    – Housni
    Commented Jan 29, 2016 at 19:08
  • 1
    github won't resolve because you're blocking DNS incoming. OK, try "ufw allow 53/tcp" and "ufw allow 53/udp" and see what happens.
    – vik
    Commented Jan 29, 2016 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .