0

I am not able to get my ufw rules working. As far as I understand, the default behavior is to deny all incoming connections thus the command

ufw allow from 192.168.4.3 to any port http

should enable incoming http connections for the specific ip. However, the requests are blocked by the firewall. I've also tried to explicitly deny and then allow but it isn't working either.

The output of ufw status verbose is

To                         Action      From
--                         ------      ----
631/tcp                    ALLOW IN    Anywhere                  
22                         ALLOW IN    Anywhere                  
80                         ALLOW IN    192.168.4.3                     
631/tcp (v6)               ALLOW IN    Anywhere (v6)             
22 (v6)                    ALLOW IN    Anywhere (v6)

The output of netstat -tulnp | grep :80 is

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 336/nginx: master p

Which part of the config / concept am I missing?

  • Can you include the output of 'ufw status verbose' above. – Simon May 14 '17 at 9:57
  • @Simon I've updated the question. – sitilge May 15 '17 at 9:15
  • Are you sure you're being firewalled out, and the server is listening to port 80? does http / port 80 show as listening on a netstat? netstat -tulnp | grep :80 – RobotJohnny May 17 '17 at 9:47
  • @RobotJohnny nginx is listening on the port. See the update above. – sitilge May 17 '17 at 19:34
1

Check the log /var/log/ufw.log. The default logging level (low) should record any blocked requests. Make sure the source IP (SRC field) matches the IP address you are expecting.

  • ufw logs to LOG_KERN syslog in my case. Yes, I've double checked the IP - nothing wrong there, they match. – sitilge May 16 '17 at 9:19
  • hmm, ufw deny from 192.168.4.3 is not working either. – sitilge May 16 '17 at 9:25
  • Just to confirm, you can see the blocked requests in the log? If so, then I would suggest maybe flushing the existing rules and starting again. You could start by allowing everyone to access port 80 then narrow it down from there if that works. The order of the rules matters. The first one to match wins, so perhaps there is an earlier rule in a different chain that is blocking the request. – Simon May 18 '17 at 10:28
0

You forget network mask. Try ufw allow from 192.168.4.3/32 to any port http

  • IMHO, that is just a longer syonym for the given IP. 32 bit netmask = zero range, single IP. – sitilge May 16 '17 at 18:44
  • @sitilge yu're right. – Alexander Tolkachev May 16 '17 at 20:07
  • @sitilge please share your network configuration. And output for netstat -tldpn. – Alexander Tolkachev May 16 '17 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.