0

I am trying to make connections possible between my Seagate Central drive on my local area network (LAN) and my computer which has debian 9 stable.

UFW is enabled on my computer and blocking any incoming and outgoing traffic by default. Another detail: I always use an OpenVPN connection.

When UFW is disabled I can connect to Seagate Central via Nautilus without any problem, even when VPN is enabled.

UFW version is 0.35 and "Samba" app is not listed by sudo ufw app list command.

I have tried this but it did not work for me.

sudo tail -f /var/log/ufw.log command shows this output "[UFW BLOCK] IN= OUT=wlp2s0 SRC=192.168.1.26 DST=224.0.0.251 LEN=66 TOS=0x00 PREC=0x00 TTL=255 ID=20807 DF PROTO=UDP SPT=5353 DPT=5353 LEN=46" for a couple of times (only "LEN" varies). Thus I allowed in UFW 5353/udp but it did not work.

How can I make UFW allow incoming/outgoing traffic between my computer and Seagate Central drive connected to my LAN?

  • 1
    That ufw entry shouldn't be relevant since the destination ip is just a multicast address. Instead disable uwf, connect to the NAS, then run netstat -ant and see which ports are being used (my guess is 139 and/or 445 if it's just SMB). At this point add the rules to ufw with sudo ufw allow port/tcp – Matteo Jul 28 '17 at 22:05
  • I followed your advice and noticed that destination ports are varying in every connection. Thus I enabled all outgoing traffic to the IP address of my NAS (and I will make that a static IP). This solves my problem. Thank you. – Teo Jul 30 '17 at 20:53
  • Yeah, that works as well. However, just to be sure, check that the destination ports (ports open on the nas) are actually changing and not the client ports, which are usually picked at random. – Matteo Jul 30 '17 at 21:09
1

To find out which ports and addresses used when there is an unblocked connection between my NAS and my computer, I used netstat -ant when ufw is disabled, as @Matteo suggested.

Then I noticed that local ports varies but source port in my NAS is fixed.

Then I used following command to allow traffic from the IP address of my NAS to a dynamic range of ports.

sudo ufw allow from <nasIP> port 57000:60000 proto tcp

This was not enough. I had to use this command to see what else is being blocked by my firewall.

sudo journalctl | grep -i ufw

Examined the log files, I noticed some connection attempts were being blocked when I try to reach my NAS.

According to my observations I added following rules:

sudo ufw allow out to <nasIP>
sudo ufw allow out to 224.0.0.251

And it finally worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.