0

I am using Debian 11 bullseye. I am trying to block some IPs by using ufw firewall. I have installed ufw package. Then I added some simple rules and start ufw by

sudo ufw enable

Then I checked its status

sudo ufw status verbose

and it gives my rules. I also enable it by using systemctl commands

sudo systemctl enable ufw
sudo systemctl start ufw

both of them also successful.
However, when I try it I saw that IP did not blocked, it can send packages to my computer. To check whether ufw it is working or not, simply I used known advertisement website's IP such as tpc.googlesyndication.com(I used ping -c 1 tpc.googlesyndication.com to find website's IP). And I added it as ufw rule by sudo ufw deny from x.x.x.x. However, I saw that IP source was sending packages to my computer(since I saw its advertisements in my browser). (I did all those in the very short time so that site did not change its IP address).

Why did not ufw work and block incoming packages? What did I do wrong?

1

1 Answer 1

2

You created a rule to block unsolicited inbound traffic, whereas you actually want to block outbound traffic.

Because your computer initiates the connection, the firewall considers its state to be established/related to an outbound connection (you initiated the connection), so it doesn't block the follow up packets received from the remote host.

You will need to block outbound traffic to that IP address

sudo ufw deny out from any to x.x.x.x

Then, reload ufw with sudo ufw reload

Additionally, many hosts on the internet have a large number of IP addresses assigned to them, and DNS queries for those hosts will return different IPs at different times. Therefore, the single IP you blocked may change, allowing traffic again. You may want to look into blocking the DNS requests for that hostname.

If the remote host you want to block is a single, static IP address which does not change, then this method will work.

You must log in to answer this question.