what's wrong with my ufw configuration on Ubuntu server?
Solution 1
If I were you I would seriously consider using something like the the iptables firewall generator to make your rules, I spend two days trying to use iptables as a router and after using this site i got it working in 5 mins.
Heres the link: http://easyfwgen.morizot.net/gen/
Hope that helps, RayQuang
Solution 2
I dump ufw and use Shorewall instead. It is installable as a package. The /usr/share/doc/shorewall/examples directory has good starting configurations. It is will documented both on the Shoreline Firewall site and in the shorewall-doc packagage.
Solution 3
May be your iptables-save is incomplete here?
If you run iptables-save - it dumps current rules. To make actual ufw rules current - you should run after configuring ufw:
# ufw enable
# /lib/ufw/ufw-init restart
Mine rules indeed contained a chain, that preventd all input traffic to pass:
*filter
...
-A INPUT -j ufw-before-input
...
-A ufw-before-input -j ufw-not-local
...
-A ufw-not-local -j DROP
which dropped all input traffic: input => ufw-before-input => ufw-not-local => DROP
i managed to fix that by modifying /etc/ufw/before.rules: comennt out this line
-A ufw-before-input -j ufw-not-local
Related videos on Youtube
Tino Fernández
Updated on September 17, 2022Comments
-
Tino Fernández over 1 year
I've setup the ufw firewall for my Ubuntu server on linode as follows:
Note that this is in the Lish terminal, unfortunately as soon as I turn on the ufw, I cannot:
view my test website via port 80 from browser, or even curl -I to get its response headers;
I cannot ssh to the server, even port 22 is "allowing access";
The default action for ufw is denying, which I believe is good practice for a "defensive" firewall. I am new to system admin stuff so I am not very sure which part I've done wrong...
Any thoughts?
UPDATED as suggested: Here are the print outs from iptables-save:
# Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010 *security :INPUT ACCEPT [80376:49275670] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [39230:5028423] COMMIT # Completed on Tue Dec 14 09:55:24 2010 # Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010 *raw :PREROUTING ACCEPT [81286:49365430] :OUTPUT ACCEPT [39230:5028423] COMMIT # Completed on Tue Dec 14 09:55:24 2010 # Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010 *nat :PREROUTING ACCEPT [1419:87729] :POSTROUTING ACCEPT [2334:168647] :OUTPUT ACCEPT [2334:168647] COMMIT # Completed on Tue Dec 14 09:55:24 2010 # Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010 *mangle :PREROUTING ACCEPT [81286:49365430] :INPUT ACCEPT [81274:49361314] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [39230:5028423] :POSTROUTING ACCEPT [39230:5028423] COMMIT # Completed on Tue Dec 14 09:55:24 2010 # Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010 *filter :INPUT ACCEPT [713:54735] :FORWARD DROP [0:0] :OUTPUT ACCEPT [666:62866] :ufw-after-forward - [0:0] :ufw-after-input - [0:0] :ufw-after-logging-forward - [0:0] :ufw-after-logging-input - [0:0] :ufw-after-logging-output - [0:0] :ufw-after-output - [0:0] :ufw-before-forward - [0:0] :ufw-before-input - [0:0] :ufw-before-logging-forward - [0:0] :ufw-before-logging-input - [0:0] :ufw-before-logging-output - [0:0] :ufw-before-output - [0:0] :ufw-logging-allow - [0:0] :ufw-logging-deny - [0:0] :ufw-not-local - [0:0] :ufw-reject-forward - [0:0] :ufw-reject-input - [0:0] :ufw-reject-output - [0:0] :ufw-skip-to-policy-forward - [0:0] :ufw-skip-to-policy-input - [0:0] :ufw-skip-to-policy-output - [0:0] :ufw-track-input - [0:0] :ufw-track-output - [0:0] :ufw-user-forward - [0:0] :ufw-user-input - [0:0] :ufw-user-limit - [0:0] :ufw-user-limit-accept - [0:0] :ufw-user-logging-forward - [0:0] :ufw-user-logging-input - [0:0] :ufw-user-logging-output - [0:0] :ufw-user-output - [0:0] -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-before-forward -j ufw-user-forward -A ufw-before-input -i lo -j ACCEPT -A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT -A ufw-before-input -m state --state INVALID -j ufw-logging-deny -A ufw-before-input -m state --state INVALID -j DROP -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT -A ufw-before-input -j ufw-not-local -A ufw-before-input -s 224.0.0.0/4 -j ACCEPT -A ufw-before-input -d 224.0.0.0/4 -j ACCEPT -A ufw-before-input -j ufw-user-input -A ufw-before-output -o lo -j ACCEPT -A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT -A ufw-before-output -j ufw-user-output -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] " -A ufw-logging-deny -m state --state INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny -A ufw-not-local -j DROP -A ufw-skip-to-policy-forward -j DROP -A ufw-skip-to-policy-input -j ACCEPT -A ufw-skip-to-policy-output -j ACCEPT -A ufw-track-input -p tcp -m state --state NEW -j ACCEPT -A ufw-track-input -p udp -m state --state NEW -j ACCEPT -A ufw-track-output -p tcp -m state --state NEW -j ACCEPT -A ufw-track-output -p udp -m state --state NEW -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 23 -j DROP -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] " -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable -A ufw-user-limit-accept -j ACCEPT COMMIT # Completed on Tue Dec 14 09:55:24 2010
-
Steven Monday over 13 yearsCould you run
sudo iptables-save
in Lish, and then update your question with its output? -
Tino Fernández over 13 years@Steven Monai: updated the output. To be frank I am not very fond of the "not-so-human-readable" iptables so I chose ufw in the hope that it would help me setup firewall... but it seems not configured right at the moment.
-
Steven Monday over 13 yearsLooking at your
iptables-save
, it does not seem like any traffic would be blocked by that configuration: All built-in chain policies are to ACCEPT (except FORWARD chain on filter table, but that's irrelevant on a box that's not a router), none of the user-defined chains are referenced anywhere, and there are no DROP or REJECT targets anywhere. Sorry, I am at a loss to explain why your web and ssh requests would be blocked by this. -
Tino Fernández over 13 years@Steven Monai: you should have made your comment as an answer so I can get you the tick :)
-
Steven Monday over 13 yearsTaking a closer look at your
iptables-save
, it seems I spoke a little hastily. There are a few DROP targets in there. However, there is no way that any of them would be reached, as they are all in user-defined chains that are not referenced. And, please, I implore you: don't assign a tick to an "answer" that doesn't solve your question! Someone out there might have the true solution, and you don't want to discourage them from posting it.