0

I have a cluster configuration with one machine that functions as a gateway (call it master) and several machines that only have private IP addresses (call them s01 to s09).

I recently installed ufw on master and noticed that the machines behind the Gateway were no longer able to access the outside internet (wget google.com fails).

I looked in my logs and saw lines that looked like this.

 [609940.531858] [UFW BLOCK] IN=eth1 OUT=eth0 MAC=00:25:90:0c:e0:5b:00:25:90:32:3c:9e:08:00 SRC=192.168.0.178 DST=172.217.6.78 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=58107 DF PROTO=TCP SPT=59584 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x9 

I added the following rule to ufw.

ufw allow from 192.168.0.178
ufw reload

Here's the output of ufw status.

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
Anywhere                   ALLOW       192.168.0.178
22                         ALLOW       Anywhere (v6)

Unfortunately, wget still fails, and I still see more UFW BLOCK lines like the above in my logs.

How do I correctly configure ufw to allow outbound traffic from the hosts behind my gateway?

1

After some investigation, it turns out that UFW defaults to rejecting forwarding requests. One potential solution was to edit /etc/default/ufw and set DEFAULT_FORWARD_POLICY="ACCEPT", but this seemed insecure.

Instead, I added the following rules to /etc/ufw/before.rules.

# Eth0 is public, Eth1 is private.
-A FORWARD -i eth1 -o eth0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.