4

Here is my status:

$ sudo ufw status verbose
Status: active
Logging: on (medium)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere

All outgoing flow are allowed. Now when I am doing:

$ wget www.google.com
--2013-07-30 14:28:00--  http://www.google.com/
Resolving www.google.com... failed: Name or service not known.
wget: unable to resolve host address `www.google.com'

What I see in /var/log/kern.log is that the traffic is, indeed, blocked:

Jul 30 14:11:27 XXXXXX kernel: [2207680.256415] [UFW BLOCK] IN=lo OUT= MAC=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=62240 DF PROTO=UDP SPT=35323 DPT=53 LEN=40 

Here is my ufw version:

$ sudo ufw version
ufw 0.29.3-1
Copyright 2008-2009 Canonical Ltd.

Is explicitly allowing outgoing traffic not enough? How to solve that? Should I add a rule for allowing the loopback interface? How to do that?

2 Answers 2

2

You need to allow established traffic back in.

At the moment your machine is trying to do a DNS lookup for www.google.com but it is never getting the result as the traffic back from the DNS server is being blocked.

2
  • shouldn't that (as well as loopback traffic) be handled by the default before.rules file though? at least that's how it seems to be in ufw 0.31.1-1 Jul 30, 2013 at 18:09
  • 1
    This answer reiterates the problem and doesn't actually answer the question of HOW. I'm also looking for the answer to this Nov 11, 2013 at 22:04
0

This command helps me solve the issue sudo ufw allow 53/udp. Port 53 is the port for DNS.

3
  • The OP's error does indicate that DNS lookups are failing, although I doubt the underlying cause is a firewall rule. Nov 20, 2015 at 9:55
  • @DavidFoerster they are, read the kernel message.
    – guntbert
    Nov 20, 2015 at 21:39
  • Ah, sorry. I overlooked the DTP=53. Nov 20, 2015 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .