0

I'm trying to set up UFW to block outgoing connections, except on a specific interface, and also except for a specific IP. Everything seems to be working as expected, except I can still send pings to IPV6 addresses - I want those to be blocked. I don't see any conflicting rules, so I'm not sure if I'm doing something wrong, or if it's a bug, or if this is expected.

I disconnect my tun0 interface, and see successfully blocked IPV4 ping:

$ ping 192.30.255.113 # github.com
PING 192.30.255.113 (192.30.255.113) 56(84) bytes of data.
ping: sendmsg: Operation not permitted

I tried an IPV6 address, but it's not getting blocked:

ping 2001:41d0:701:1100::29c8 # ipv6-test.com
PING 2001:41d0:701:1100::29c8(2001:41d0:701:1100::29c8) 56 data bytes
64 bytes from 2001:41d0:701:1100::29c8: icmp_seq=1 ttl=42 time=181 ms
64 bytes from 2001:41d0:701:1100::29c8: icmp_seq=2 ttl=42 time=181 ms

Here is my UFW config:

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         LIMIT IN    Anywhere
Anywhere on tun0           ALLOW IN    Anywhere
22 (v6)                    LIMIT IN    Anywhere (v6)
Anywhere (v6) on tun0      ALLOW IN    Anywhere (v6)

Anywhere                   ALLOW OUT   Anywhere on tun0
1.2.3.4 1234               ALLOW OUT   Anywhere
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on tun0

Why is that?

3
  • R u absolutely sure tun0 is down? What does sudo iptables-save return? Dec 15, 2020 at 8:04
  • Ooops, sorry I actually needed ip6tables-save Dec 15, 2020 at 8:22
  • @ArtemS.Tashkinov I'm an idiot and originally posted the output while I still had ufw disabled so I can get online to post this... my issue is still the same, here is the corrected output pastebin.com/raw/z8U5PqfF
    – Slim
    Dec 15, 2020 at 20:51

1 Answer 1

1

All your IPv6 policies according to your ip6tables-save output are ACCEPT. Also you don't have any actual enabled IPv6 rules aside from predefined ufw tables which do nothing.

Please make sure /etc/default/ufw contains IPV6=yes and run sudo ufw reload.


I've followed your bug report and there's no bug. Default ufw IPv6 policy contains a rule which allows to ping any host on the net (icmp6 type 128).

From docs:

When you turn UFW on, it uses a default set of rules (profile) that should be fine for the average home user. That's at least the goal of the Ubuntu developers. In short, all 'incoming' is being denied, with some exceptions to make things easier for home users.

Perhaps you'll need to edit some files in order to disable these rules or add a DROP/REJECT target as the first rule for incoming/outgoing chains:

Please check:

https://wiki.ubuntu.com/UncomplicatedFirewall#Advanced_Functionality

https://help.ubuntu.com/community/UFW#Working_with_numbered_rules

8
  • My ufw file already contained that, here's the full file, as well as sysctl.conf. I've also reloaded and rebooted with the same behavior pastebin.com/SSSrb8j6
    – Slim
    Dec 15, 2020 at 12:26
  • My conf the same as upstream source git.launchpad.net/ufw/tree/conf I believe 'sudo ufw default deny outgoing' should be blocking these pings. Or at least I can't see why they shouldn't be blocked.
    – Slim
    Dec 15, 2020 at 12:46
  • File a bug report against ufw. You have zero iptables ipv6 rules enabled. Dec 15, 2020 at 13:21
  • Sorry, I had ufw temporarily disabled and didn't think to record the iptables output before doing so...posted the new link as a comment above
    – Slim
    Dec 15, 2020 at 20:52
  • 1
    Let's see what developers have to say. Dec 16, 2020 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .