2

I have a cluster configuration with one machine that functions as a gateway (call it master) and several machines that only have private IP addresses (call them s01 to s09).

I recently installed ufw on master and noticed that the machines behind the Gateway were no longer able to access the outside internet (wget google.com fails).

I looked in my logs and saw lines that looked like this.

 [609940.531858] [UFW BLOCK] IN=eth1 OUT=eth0 MAC=00:25:90:0c:e0:5b:00:25:90:32:3c:9e:08:00 SRC=192.168.0.178 DST=172.217.6.78 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=58107 DF PROTO=TCP SPT=59584 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x9 

I added the following rule to ufw.

ufw allow from 192.168.0.178
ufw reload

Here's the output of ufw status.

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
Anywhere                   ALLOW       192.168.0.178
22                         ALLOW       Anywhere (v6)

Unfortunately, wget still fails, and I still see more UFW BLOCK lines like the above in my logs.

How do I correctly configure ufw to allow outbound traffic from the hosts behind my gateway?

1 Answer 1

3

After some investigation, it turns out that UFW defaults to rejecting forwarding requests. One potential solution was to edit /etc/default/ufw and set DEFAULT_FORWARD_POLICY="ACCEPT", but this seemed insecure.

Instead, I added the following rules to /etc/ufw/before.rules.

# Eth0 is public, Eth1 is private.
-A FORWARD -i eth1 -o eth0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2
  • Thank you, this answer just helped me a lot. Maybe saved hours.
    – orion3
    Commented Mar 14, 2023 at 11:36
  • Glad it's still useful after 4.5 years!
    – merlin2011
    Commented Mar 14, 2023 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .