ufw firewall deny outgoing but allow browser

Question

I want to configure ufw firewall in a way, where I can allow "browser" surfing but deny all another outgoing.

I have denied outgoing using gufw but it blocked surfing too, so, I allowed "outgoing" anywhere http (80) and https (443), but was still not able to surf the internet.

Need help in setting up deny outgoing but still allow surfing internet with the browser.

Solution

The first thing you need to do is to change the default outgoing policy to deny. By default all outgoing traffic is allowed.

sudo ufw default deny outgoing

Then you must allow outgoing traffic on both port 80 and 443 with these commands:

sudo ufw allow out to any port 80
sudo ufw allow out to any port 443

Finally, since web browsing require access to a DNS server you must also allow port 53:

sudo ufw allow out to any port 53

Then reload the firewall rules:

sudo ufw reload

Confirm the changes with: sudo ufw status verbose

Comments

[2707974]

Do you allow outgoing connection to DNS?

[user3767643]

It's home PC. do i need to do that ?

[2707974]

Yes, you must. You PC use DNS to resolve logical name aka www.example.com to ip address. Without ip address for destination network traffic will not be router.

[user3767643]

Doesn't work , I just follow the exact rules mentioned above and I get the error "There is no Internet connection", so I was not able to write comment. After setting ALLOW to outgoing, I am having access to internet again. I am using "Google Chrome" and "firefox" as my browser.

[Admin]

Hm okay, it works on my machine that is a freshly installed Ubuntu 18.04 Desktop. Have you got an IP address if you run ifconfig? What are the result of "nslookup www.google.com"?

[Admin]

If you take a look in /var/log/ufw.log, are there any rows that contain "[UFW BLOCK]" together with "DPT=53", "DPT=80" or "DPT=443"? Where DPT is the destination port number.

[user3767643]

Yes, I found there were some BLOCK and I realised, I did mistake, instead of ALLOW OUT, I did ALLOW IN and after fixing typo. It is working super fine. This is amazing. Thanks