So I denied everything except DNS, HTTPS and HTTP in the gufw firewall. ufw status verbose looks good with no DENY for port 53 and only allows at the bottom of it. I even executed sudo ufw allow 53/udp and also tried setting the DNS nameserver to Still it doesn't work: apt-get update gives me "Temporary failure resolving 'security.debian.org'". Pings don't work either.

In /var/log/syslog it also says:

WARNING: Can't read main.cvd header from db.local.clamav.net (IP: )
WARNING: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): ERROR: Can't get information about database.clamav.net: Temporary failure in name resolution.


Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)

avahi-daemon is set to DENY in case that matters.
Also a ClamAV scan found the same as listed in my question here

It worked earlier using iptables which basically had the same rules for DNS.

I'm running a freshly installed Debian 9.1 with KDE.

Any ideas what might be causing this? How can I get it working?

  • 1
    DNS uses 53/tCP too – Rui F Ribeiro Aug 4 '17 at 3:46
  • @RuiFRibeiro Had that allowed too. I now explicitly allowed it via ufw allow 53/tcp and it still doesn't work. – mYnDstrEAm Aug 4 '17 at 8:37
  • 1
    use dig to troubleshoot and then see with tcpdump/wireshark if packets are sent correctly first – Patrick Mevzek Aug 6 '17 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.