0

I have ufw running on an Ubuntu 16.04 host that acts as the router between the Internet and my LAN. (I'm using ufw instead of raw iptables, because manually unblocking enough ICMPv6 to make IPv6 work at all is too messy.)

It appears that ufw rules denying incoming traffic on the WAN interface don't affect traffic destined to hosts other than the router itself. For example, ufw deny in on $WAN_INTERFACE to any proto tcp (where $WAN_INTERFACE obviously stands in for the WAN interface of the router) does not block incoming TCP connections to non-router hosts on the LAN. (The LAN hosts have global IPv6 addresses, so they are addressable. ufw reports that IPv6 rules get added.)

How do I default-block incoming TCP connections on the WAN interface regardless of destination host and block incoming privileged-port UDP connections on the WAN interface regardless of destination host using ufw? (I want to allow upper UDP ports for WebRTC.)

closed as off-topic by Jeff Schaller, Anthon, GAD3R, Stephen Rauch, Kusalananda Sep 17 '17 at 19:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, Anthon, GAD3R, Stephen Rauch, Kusalananda
If this question can be reworded to fit the rules in the help center, please edit the question.

  • UFW is definitely not the best candidate to do a firewall as there is too many limitation like traffic forwarding. I can suggest you to use Shorewall instead as it supports many rules and zones. If you still want to use UFW, you must have to deal with before.rules and after.rules from /etc/ufw/ folder where you can place manual iptables rules. – ob2 Sep 13 '17 at 6:46
1

Turns out that the route keyword is needed to make a rule that applies to forwarding. Hence: ufw route deny in on $WAN_INTERFACE to any proto tcp

Not the answer you're looking for? Browse other questions tagged or ask your own question.