1

I recently had the following conflicting rules on ufw

445/tcp      ALLOW      192.168.1.0/24
445          DENY       anywhere
445          DENY       anywhere IPV6

because I first blocked the 445 to then allow it only on my subnet. I was doing that as part of the samba configuration on my local network and I noticed that such conflicting rules did not impact some of my devices (2 pcs and a playstation connecting to the samba server) but impacted an android phone connecting to the server.

I could do some tests here to try to infer how does ufw handle those "conflicting rules", however I though I would probably get a more accurate answer here =D

Does ufw overwrite the ALLOWS on top of the DENYs? Or how does it handle those type of conflicts?

1 Answer 1

5

ufw does not "handle the conflicts" in any way, it just puts the rules into an iptables chain which follows the first-match policy.

So if a packet matches a rule which drops it, it will be dropped regardless of any other matching rules which may follow.

2
  • does that mean that the drop rule overwrite the allow rule? Or it is really by the order in which the rule has been added, so if I first add an allow and then a deny, it will allow?
    – Thomas
    Jul 23, 2013 at 21:16
  • a) It doesn't "overwrite" it, it is just executed and no other rules are examined. b) yes. BTW: in ufw you can use the insert keyword to insert rules anywhere in the ruleset.
    – arrange
    Jul 23, 2013 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .