Results 1 to 5 of 5

Thread: UFW blocking connections.

  1. #1
    Join Date
    Sep 2013
    Beans
    2

    UFW blocking connections.

    Hi.

    I have some kind of weird issue with UFW (Ubuntu 12.04 LTS). It keeps blocking legitimate connections outwards after the connection is established and data being transmitted. For example:

    Code:
    [ 2070.653627] [UFW BLOCK] IN=eth0 OUT= MAC= SRC= DST= LEN=64 TOS=0x00 PREC=0x00 TTL=61 ID=63075 DF PROTO=TCP SPT=22 DPT=37254 WINDOW=6028 RES=0x00 ACK URGP=0
    If I disable UFW, then for example, sftp/ftp/scp/rsync will upload data without stalling.

    Appreciate your help


    Thx,
    /mysteron

  2. #2
    Join Date
    Aug 2009
    Beans
    Hidden!

    Re: UFW blocking connections.

    Quote Originally Posted by mysteron2 View Post
    It keeps blocking legitimate connections outwards after the connection is established and data being transmitted.
    Start by posting active UFW rules / configuration and 'iptables-save' output?

  3. #3
    Join Date
    Sep 2013
    Beans
    2

    Re: UFW blocking connections.

    Hi.

    This is the ufw verbose output:

    Code:
    Status: active
    Logging: on (low)
    Default: deny (incoming), allow (outgoing)
    New profiles: skip
    
    To                         Action      From
    --                         ------      ----
    135,139,445/tcp            ALLOW IN    Anywhere
    137,138/udp                ALLOW IN    Anywhere
    22/tcp (OpenSSH)           ALLOW IN    Anywhere
    and this is the iptables -nL output:

    Code:
    Chain INPUT (policy DROP)
    target     prot opt source               destination         
    ufw-before-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-before-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-reject-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-track-input  all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination         
    ufw-before-logging-forward  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-before-forward  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-forward  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-logging-forward  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-reject-forward  all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination         
    ufw-before-logging-output  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-before-output  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-output  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-logging-output  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-reject-output  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-track-output  all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-after-forward (1 references)
    target     prot opt source               destination         
    
    Chain ufw-after-input (1 references)
    target     prot opt source               destination         
    ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:137
    ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:138
    ufw-skip-to-policy-input  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:139
    ufw-skip-to-policy-input  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:445
    ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:67
    ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:68
    ufw-skip-to-policy-input  all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    
    Chain ufw-after-logging-forward (1 references)
    target     prot opt source               destination         
    LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
    
    Chain ufw-after-logging-input (1 references)
    target     prot opt source               destination         
    LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
    
    Chain ufw-after-logging-output (1 references)
    target     prot opt source               destination         
    
    Chain ufw-after-output (1 references)
    target     prot opt source               destination         
    
    Chain ufw-before-forward (1 references)
    target     prot opt source               destination         
    ufw-user-forward  all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-before-input (1 references)
    target     prot opt source               destination         
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    ufw-logging-deny  all  --  0.0.0.0/0            0.0.0.0/0            state INVALID
    DROP       all  --  0.0.0.0/0            0.0.0.0/0            state INVALID
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 3
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 4
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 11
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 12
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
    ufw-not-local  all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251          udp dpt:5353
    ACCEPT     udp  --  0.0.0.0/0            239.255.255.250      udp dpt:1900
    ufw-user-input  all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-before-logging-forward (1 references)
    target     prot opt source               destination         
    
    Chain ufw-before-logging-input (1 references)
    target     prot opt source               destination         
    
    Chain ufw-before-logging-output (1 references)
    target     prot opt source               destination         
    
    Chain ufw-before-output (1 references)
    target     prot opt source               destination         
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    ufw-user-output  all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-logging-allow (0 references)
    target     prot opt source               destination         
    LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
    
    Chain ufw-logging-deny (2 references)
    target     prot opt source               destination         
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0            state INVALID limit: avg 3/min burst 10
    LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
    
    Chain ufw-not-local (1 references)
    target     prot opt source               destination         
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    ufw-logging-deny  all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-reject-forward (1 references)
    target     prot opt source               destination         
    
    Chain ufw-reject-input (1 references)
    target     prot opt source               destination         
    
    Chain ufw-reject-output (1 references)
    target     prot opt source               destination         
    
    Chain ufw-skip-to-policy-forward (0 references)
    target     prot opt source               destination         
    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-skip-to-policy-input (7 references)
    target     prot opt source               destination         
    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-skip-to-policy-output (0 references)
    target     prot opt source               destination         
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-track-input (1 references)
    target     prot opt source               destination         
    
    Chain ufw-track-output (1 references)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            state NEW
    
    Chain ufw-user-forward (1 references)
    target     prot opt source               destination         
    
    Chain ufw-user-input (1 references)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 135,139,445
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 137,138
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 /* 'dapp_OpenSSH' */
    
    Chain ufw-user-limit (0 references)
    target     prot opt source               destination         
    LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
    REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    
    Chain ufw-user-limit-accept (0 references)
    target     prot opt source               destination         
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain ufw-user-logging-forward (0 references)
    target     prot opt source               destination         
    
    Chain ufw-user-logging-input (0 references)
    target     prot opt source               destination         
    
    Chain ufw-user-logging-output (0 references)
    target     prot opt source               destination         
    
    Chain ufw-user-output (1 references)
    target     prot opt source               destination
    This is the iptables-save output:

    Code:
    # Generated by iptables-save v1.4.12 on Thu Sep 26 15:20:40 2013
    *filter
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT ACCEPT [0:0]
    :ufw-after-forward - [0:0]
    :ufw-after-input - [0:0]
    :ufw-after-logging-forward - [0:0]
    :ufw-after-logging-input - [0:0]
    :ufw-after-logging-output - [0:0]
    :ufw-after-output - [0:0]
    :ufw-before-forward - [0:0]
    :ufw-before-input - [0:0]
    :ufw-before-logging-forward - [0:0]
    :ufw-before-logging-input - [0:0]
    :ufw-before-logging-output - [0:0]
    :ufw-before-output - [0:0]
    :ufw-logging-allow - [0:0]
    :ufw-logging-deny - [0:0]
    :ufw-not-local - [0:0]
    :ufw-reject-forward - [0:0]
    :ufw-reject-input - [0:0]
    :ufw-reject-output - [0:0]
    :ufw-skip-to-policy-forward - [0:0]
    :ufw-skip-to-policy-input - [0:0]
    :ufw-skip-to-policy-output - [0:0]
    :ufw-track-input - [0:0]
    :ufw-track-output - [0:0]
    :ufw-user-forward - [0:0]
    :ufw-user-input - [0:0]
    :ufw-user-limit - [0:0]
    :ufw-user-limit-accept - [0:0]
    :ufw-user-logging-forward - [0:0]
    :ufw-user-logging-input - [0:0]
    :ufw-user-logging-output - [0:0]
    :ufw-user-output - [0:0]
    -A INPUT -j ufw-before-logging-input
    -A INPUT -j ufw-before-input
    -A INPUT -j ufw-after-input
    -A INPUT -j ufw-after-logging-input
    -A INPUT -j ufw-reject-input
    -A INPUT -j ufw-track-input
    -A FORWARD -j ufw-before-logging-forward
    -A FORWARD -j ufw-before-forward
    -A FORWARD -j ufw-after-forward
    -A FORWARD -j ufw-after-logging-forward
    -A FORWARD -j ufw-reject-forward
    -A OUTPUT -j ufw-before-logging-output
    -A OUTPUT -j ufw-before-output
    -A OUTPUT -j ufw-after-output
    -A OUTPUT -j ufw-after-logging-output
    -A OUTPUT -j ufw-reject-output
    -A OUTPUT -j ufw-track-output
    -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
    -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
    -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
    -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
    -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
    -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
    -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
    -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
    -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
    -A ufw-before-forward -j ufw-user-forward
    -A ufw-before-input -i lo -j ACCEPT
    -A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-input -m state --state INVALID -j ufw-logging-deny
    -A ufw-before-input -m state --state INVALID -j DROP
    -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
    -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
    -A ufw-before-input -j ufw-not-local
    -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
    -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
    -A ufw-before-input -j ufw-user-input
    -A ufw-before-output -o lo -j ACCEPT
    -A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-output -j ufw-user-output
    -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
    -A ufw-logging-deny -m state --state INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
    -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
    -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
    -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
    -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
    -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
    -A ufw-not-local -j DROP
    -A ufw-skip-to-policy-forward -j DROP
    -A ufw-skip-to-policy-input -j DROP
    -A ufw-skip-to-policy-output -j ACCEPT
    -A ufw-track-output -p tcp -m state --state NEW -j ACCEPT
    -A ufw-track-output -p udp -m state --state NEW -j ACCEPT
    -A ufw-user-input -p tcp -m multiport --dports 135,139,445 -j ACCEPT
    -A ufw-user-input -p udp -m multiport --dports 137,138 -j ACCEPT
    -A ufw-user-input -p tcp -m tcp --dport 22 -m comment --comment "\'dapp_OpenSSH\'" -j ACCEPT
    -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
    -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
    -A ufw-user-limit-accept -j ACCEPT
    COMMIT
    # Completed on Thu Sep 26 15:20:40 2013
    Thx,
    /mysteron
    Last edited by mysteron2; September 26th, 2013 at 01:22 PM.

  4. #4
    Join Date
    Aug 2009
    Beans
    Hidden!

    Re: UFW blocking connections.

    If I compress it it kind of looks like this:
    Code:
    # Generated by iptables-save v1.4.12 on Thu Sep 26 15:20:41 2013
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -m state --state INVALID -j DROP
    -A INPUT -p tcp -m multiport --dports 135,139,445 -m state --state NEW -j ACCEPT
    -A INPUT -p udp -m multiport --dports 137,138 -m state --state NEW -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "\'dapp_OpenSSH\'" -j ACCEPT
    -A INPUT -p udp -m udp --sport 67 --dport 68 -m state --state NEW -j ACCEPT
    -A INPUT -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
    -A INPUT -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
    -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
    -A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
    -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
    -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
    -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
    -A INPUT -m limit --limit 3/min -j LOG --log-prefix "in_REJ "
    -A INPUT -j REJECT --reject-with icmp-port-unreachable
    -A OUTPUT -o lo -j ACCEPT
    # Completed on Thu Sep 26 15:20:41 2013
    Could try it, save to file then 'iptables-restore < saved_file' but YMMV(VM) as usual :-]

  5. #5
    Join Date
    Apr 2014
    Beans
    1

    Re: UFW blocking connections.

    Same here. I use UFW with default settings. Only added a few allow rules for some of my TCP ports (to let traffic in).
    However I only experienced the problem with Thunderbird and sending emails with "large" (1-2 MB) attachments via a Debian Exim4 server.
    If I disable UFW, the problem disappears.
    If I enabled UFW, I get blocked TCP packets that come from the email server to my computer.
    I only get this when sending email (via SMTP + SSL ... using the email server's 465 TCP port).
    I've no problem connecting to the server via IMAPS.

    I've traced the problem to these two rules in the ufw-before-input chain:
    ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 state INVALID
    DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID

    The first one logs the "invalid" packet, the second one drops it.
    But even if I get rid of the second rule, the same packets are dropped by the ufw-reject-input chain ... since apparently no rule in ufw-before-input accepted the packet.
    For some reason some packets (coming from the server to Thunderbird) are not considered RELATED or ESTABLISHED.
    Strange.
    And this a pretty much consistent and reproducable issue for me.
    So if anyone'd be willing to help, I could provide further logs, try various rules, etc.
    I'm open to suggestions.
    And thanks for any help.

    P.S.: my setup is ...
    Ubuntu 13.10 (x86_64)
    iptables 1.4.18-1.1ubuntu1
    linux-image-3.11.0-19-generic 3.11.0-19.33
    linux-image-extra-3.11.0-19-generic 3.11.0-19.33
    Last edited by zsolt3; April 8th, 2014 at 10:10 AM.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •