Results 1 to 6 of 6

Thread: Firewall rules not working as intended

  1. #1
    Join Date
    Feb 2020
    Beans
    1

    Firewall rules not working as intended

    I'm trying to use only UFW from now on, but I think that there may be some remnant rules in IPTABLES which are causing issues. Ideally, I'd like to reset those to default, but that didn't seem to work when I tried it, so if someone has a good help doc for that, I'd appreciate it.

    Ubuntu 18.04

    Below are my UFW and IPTABLES rules.


    Here's the issue:
    Although UFW explicitly DENIES port 943 traffic in, I can still access a web page on that port.


    Any ideas?


    ps- anything else you see in there which could come out, please feel free to point out.

    Code:
    [ UFW ] 
    root@localhost:~# ufw status verbose
    Status: active
    Logging: on (low)
    Default: deny (incoming), allow (outgoing), deny (routed)
    New profiles: skip
    
    
    To                         Action      From
    --                         ------      ----
    22                         ALLOW IN    Anywhere
    80                         ALLOW IN    Anywhere
    443                        ALLOW IN    Anywhere
    943                        DENY IN     Anywhere
    
    
    ************************************************************************
    
    
    [ IPTABLES ] 
    root@localhost:~# sudo iptables -S | less
    -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
    -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
    -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
    -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
    -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
    -A ufw-before-input -j ufw-not-local
    -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
    -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
    -A ufw-before-input -j ufw-user-input
    -A ufw-before-output -o lo -j ACCEPT
    -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-output -j ufw-user-output
    -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
    -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
    -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
    -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
    -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
    -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
    -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
    -A ufw-not-local -j DROP
    -A ufw-skip-to-policy-forward -j DROP
    -A ufw-skip-to-policy-input -j DROP
    -A ufw-skip-to-policy-output -j ACCEPT
    -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
    -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
    -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
    -A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
    -A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT
    -A ufw-user-input -p udp -m udp --dport 443 -j ACCEPT
    -A ufw-user-input -p tcp -m tcp --dport 943 -j DROP
    -A ufw-user-input -p udp -m udp --dport 943 -j DROP
    -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
    -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
    -A ufw-user-limit-accept -j ACCEPT
    Last edited by localgeek2; 1 Week Ago at 02:33 AM. Reason: More info and code tags

  2. #2
    Join Date
    Feb 2008
    Location
    Texas
    Beans
    27,896
    Distro
    Ubuntu 18.04 Bionic Beaver

    Re: Firewall rules not working as intended

    Hello and welcome to the forum.

    Please use code tags - if you are using New Reply button - highlight text and use the # button in the text box header.

    If using Quick Reply then [code] at the beginning and [/code] at the end, if you are editing a post to add code tags click the edit button then click the go advanced button, highlight the code then select the # symbol from the tool bar.

  3. #3
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    18,819
    Distro
    Ubuntu Mate 16.04 Xenial Xerus

    Re: Firewall rules not working as intended

    I don't see any left over iptable rules.

    The default rule is to deny all inbound new connections. The specific rule for 943 isn't needed. If the intent is also to block all outbound access, unless specifically allowed, you'll need more rules for that.

    However, inbound rules don't impact when a program on the system accesses another system. That opens a connection and allows the response. That's kinda the entire point of connection tracking firewalls.

    Not too important, but using sudo when already root is a waste.

  4. #4
    Join Date
    Feb 2011
    Location
    Coquitlam, B.C. Canada
    Beans
    2,779
    Distro
    Ubuntu Development Release

    Re: Firewall rules not working as intended

    Your iptables rules listing seems incomplete, therefore we can not answer your question. Do this: "sudo iptables -v -x -n -L" and post it all, although I find ufw generated rule sets difficult to follow.
    Any follow-up information on your issue would be appreciated. Please have the courtesy to report back.

  5. #5
    Join Date
    Sep 2014
    Location
    United States
    Beans
    81
    Distro
    Ubuntu 18.04 Bionic Beaver

    Re: Firewall rules not working as intended

    Whenever I have a problem with ufw rules, it is likely due to order. If you could please post your rules from the ufw stdout, that would be helpful in checking the order of your rules. Essentially, if you have a "accept all" rule at the bottom, it overrides rules at the top.

  6. #6
    Join Date
    Mar 2007
    Location
    Denver, CO
    Beans
    7,809
    Distro
    Ubuntu Mate 16.04 Xenial Xerus

    Re: Firewall rules not working as intended

    Quote Originally Posted by Doug S View Post
    Your iptables rules listing seems incomplete, therefore we can not answer your question. Do this: "sudo iptables -v -x -n -L" and post it all, although I find ufw generated rule sets difficult to follow.
    Second that. ufw is usually easy to use, however if you ever have to do some serious debugging its a royal PITA to manually debug the iptables rulesets.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •