2

I have a server on ip 192.168.1.200

My goals are:

  1. I should be able to log in to my server via port 22 from anywhere
  2. From inside 192.168.1.200 I should be able to access the Internet via ports 443 and 80
  3. From inside 192.168.1.200 I should be able to access DNS
  4. From inside 192.168.1.200 I should not be able to access the private networks: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
  5. Anything from anywhere should be able to access 192.168.0.200 via port 443 or port 80

When I reboot 192.168.1.200 I can no longer access it and I have to log in to it manually and disable ufw

Can anyone suggest what I am doing wrong?

thanks!

ubuntu:~> sudo ufw status verbose
WARN: uid is 0 but '/etc' is owned by 501
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)

Anywhere                   DENY OUT    10.0.0.0/8
Anywhere                   DENY OUT    172.16.0.0/12
Anywhere                   DENY OUT    192.168.0.0/16
53                         ALLOW OUT   Anywhere
80/tcp                     ALLOW OUT   Anywhere
443/tcp                    ALLOW OUT   Anywhere
53 (v6)                    ALLOW OUT   Anywhere (v6)
80/tcp (v6)                ALLOW OUT   Anywhere (v6)
443/tcp (v6)               ALLOW OUT   Anywhere (v6)

ubuntu:~> sudo reboot

Connection to 192.168.1.200 closed by remote host.
Connection to 192.168.1.200 closed.
foo@M1-Mac-mini ~ % ssh [email protected]

iptables -nvL

Chain INPUT (policy DROP 4 packets, 208 bytes)
pkts bytes target     prot opt in     out     source               destination
43  2920 ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
43  2920 ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4   208 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
0     0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
30  5156 ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
30  5156 ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
0     0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
pkts bytes target     prot opt in     out     source               destination
4   208 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
0     0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
38  2624 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
5   296 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
5   296 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
25  4140 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
5  1016 ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
pkts bytes target     prot opt in     out     source               destination
0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
pkts bytes target     prot opt in     out     source               destination
5   296 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-forward (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
pkts bytes target     prot opt in     out     source               destination
1    88 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 /* 'dapp_OpenSSH' */
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Chain ufw-user-limit (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 DROP       all  --  *      *       10.0.0.0/8           0.0.0.0/0
0     0 DROP       all  --  *      *       172.16.0.0/12        0.0.0.0/0
5  1016 DROP       all  --  *      *       192.168.0.0/16       0.0.0.0/0
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
7
  • 1
    Add iptables -nvL to question
    – gapsf
    Sep 18, 2022 at 4:42
  • ssh -vvv [email protected], ping 192.168.1.200
    – gapsf
    Sep 18, 2022 at 5:37
  • Temporarly remove deny output 192.168.0.0/16, fix /etc owner
    – gapsf
    Sep 18, 2022 at 6:06
  • 1
    In this setup outgoing traffic blocks new flows before allowing. That means DNS with a DNS server in 192.168.0.0/16 is not working. DHCP could also be not working with some dhcp clients. What should work is incoming SSH. So what I can imagine (there are certainly other cases) either SSH checks DNS and is slowed (or rejects) because DNS is not available or after reboot the server is using DHCP and fails to get an address. Here testing this ruleset didn't prevent the test to accept ssh, so it's about what difference there is left.
    – A.B
    Sep 18, 2022 at 6:53
  • 1
    every time I am convinced that ufw, firewalld,[whatever] does not simplify real-life firewalling and you forced to check what rules they are generate and understand how iptables/nftables/networking works
    – gapsf
    Sep 18, 2022 at 8:35

1 Answer 1

0

After much trial and error, this seems to solve my requirements:

  • allows HTTP/HTTPS and DNS requests in from the Internet
  • allows HTTP/HTTPS and DNS requests out to the Internet
  • denies access to any private network allows access via SSH from anywhere

First, run the requirements check for ufw:

sh /usr/share/ufw/check-requirements

The commands:

sudo ufw deny out to 169.254.0.0/16
sudo ufw deny out to 192.168.0.0/16
sudo ufw deny out to 198.18.0.0/15
sudo ufw deny out to 172.16.0.0/12
sudo ufw deny out to 100.64.0.0/10
sudo ufw deny out to 10.0.0.0/8
sudo ufw allow out 53/tcp
sudo ufw allow out 53/udp
sudo ufw allow out http
sudo ufw allow out https
sudo ufw allow in http
sudo ufw allow in https
sudo ufw allow in 22/tcp
sudo ufw default deny incoming
sudo ufw default deny outgoing

Status output:

ubuntu:~> sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80/tcp                     ALLOW IN    Anywhere
443                        ALLOW IN    Anywhere
22/tcp                     ALLOW IN    Anywhere
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443 (v6)                   ALLOW IN    Anywhere (v6)
22/tcp (v6)                ALLOW IN    Anywhere (v6)

169.254.0.0/16             DENY OUT    Anywhere
192.168.0.0/16             DENY OUT    Anywhere
198.18.0.0/15              DENY OUT    Anywhere
172.16.0.0/12              DENY OUT    Anywhere
100.64.0.0/10              DENY OUT    Anywhere
10.0.0.0/8                 DENY OUT    Anywhere
53/tcp                     ALLOW OUT   Anywhere
53/udp                     ALLOW OUT   Anywhere
80/tcp                     ALLOW OUT   Anywhere
443                        ALLOW OUT   Anywhere
53/tcp (v6)                ALLOW OUT   Anywhere (v6)
53/udp (v6)                ALLOW OUT   Anywhere (v6)
80/tcp (v6)                ALLOW OUT   Anywhere (v6)
443 (v6)                   ALLOW OUT   Anywhere (v6)

And: sudo iptables -nvL

Chain INPUT (policy DROP 12 packets, 2040 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2659  862K ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2659  862K ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2223  756K ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2799  351K ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2799  351K ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2374  280K ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
    0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
    0     0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
   10  1700 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   42  2876 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
   12  2040 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
   12  2040 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
   26  4760 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
 pkts bytes target     prot opt in     out     source               destination
   12  2040 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22

Chain ufw-user-limit (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            169.254.0.0/16
    0     0 DROP       all  --  *      *       0.0.0.0/0            192.168.0.0/16
    0     0 DROP       all  --  *      *       0.0.0.0/0            198.18.0.0/15
    0     0 DROP       all  --  *      *       0.0.0.0/0            172.16.0.0/12
    0     0 DROP       all  --  *      *       0.0.0.0/0            100.64.0.0/10
    0     0 DROP       all  --  *      *       0.0.0.0/0            10.0.0.0/8
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443
3
  • Compare allow in old and new output of ufw status. From ufw point of view rules are the same. Can you also add iptables -nvL output.
    – gapsf
    Sep 19, 2022 at 0:02
  • If you not use ipv6 i recommend to disable it
    – gapsf
    Sep 19, 2022 at 0:09
  • Yeah I see what you mean. Weird. Anyhow it seems to work now. Sep 19, 2022 at 0:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .