Problems allowing outgoing multicast in ufw

Question

I am having problems configuring the uncomplicated firewall (ufw) to allow outgoing multicast traffic. I am blocking all in and outgoing connections as the default policy. I have supplemented with the rules listed below. Yet, I get these error messages repeated twice after every time I boot the system:

Errors (repeated twice on boot-up):

[UFW BLOCK] IN= OUT=eth0 SRC=192.168.0.2 DST=224.0.0.22 LEN=40 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2

[UFW BLOCK] IN= OUT=eth0 SRC=fe80:0000:0000:0000:f66d:feee:feee:feee DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=56 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0

[UFW BLOCK] IN= OUT=eth0 SRC=fe80:0000:0000:0000:f66d:04ff:feee:df54 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0

Main rules:

ufw allow out proto udp to 224.0.0.0/3
ufw allow out proto udp to ff00::/8
ufw allow in  proto udp to 224.0.0.0/3
ufw allow in  proto udp to ff00::/8

in

/etc/ufw/user.rules:
-A ufw-before-input  -p igmp -d 224.0.0.0/3 -j ACCEPT
-A ufw-before-output -p igmp -d 224.0.0.0/3 -j ACCEPT

and in

/etc/ufw/user6.rules:
-A ufw6-before-input  -p icmpv6 -d ff00::/8 -j ACCEPT
-A ufw6-before-output -p icmpv6 -d ff00::/8 -j ACCEPT

Solution

I have seen similar messages in the log and the following worked for me:

Editing /etc/ufw/before.rules, I added:

\# allow igmp codes from my local sub-net
-A ufw-before-input -p igmp -m ttl --ttl-eq 1 -j ACCEPT

and to /etc/ufw/before6.rules, I added:

\# allow multicast group membership maintenance
-A ufw6-before-output -p icmpv6 --icmpv6-type 130 -m hl --hl-eq 1 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type 131 -m hl --hl-eq 1 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type 132 -m hl --hl-eq 1 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type 143 -m hl --hl-eq 1 -j ACCEPT

\# allow multicast group membership maintenance go in as well
-A ufw6-before-input -p icmpv6 --icmpv6-type 130 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type 131 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type 132 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type 143 -j ACCEPT

Note, however that the messages blocked were group membership queries from the local router, I have no actual program running that use IP multicast at all.

The log entries were gone after making the above configuration changes.

Comments

[ssb]

Please note that the multicast range is not 224.0.0.0/3. It is 224.0.0.0/4 because the addresses from 240.0.0.0 up are not multicast.