Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have UFW, OpenVPN and Virtualbox installed on my home server. I have a host-only network for my virtual machine guests (vboxnet0) set up with the IP range, and another IP range of configured on the other end of the OpenVPN connection.

IP Forwarding is configured on the host, so when UFW is disabled they can talk to each other without any issues. However, I'd like to run UFW as this host will be web-accessible and I'd like some access control.

How can I configure UFW to allow this sort of traffic?

I've tried various combinations of: ufw allow allow in|out on vboxnet0|tun0 with no success.

My UFW rules are:

root@gimli:~# ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
Anywhere                   ALLOW
Anywhere on vboxnet0       ALLOW       Anywhere
Anywhere on tun0           ALLOW       Anywhere

Anywhere                   ALLOW OUT   Anywhere on vboxnet0
Anywhere                   ALLOW OUT   Anywhere on tun0

Any help would be greatly appreciated.

share|improve this question
up vote 11 down vote accepted

I figured it out.

Edit /etc/default/ufw and set DEFAULT_FORWARD_POLICY to ACCEPT:

share|improve this answer
Is there any way of allowing only it to forward specific ports, not setting it to ACCEPT everything? – Marcus Downing Jul 24 '13 at 15:11

if you set the DEFAULT_FORWARD_POLICY to ACCEPT in /etc/default/ufw the firewall will forward all packets regardless of the settings of the user interface.

I think the user interface is only meant for simple in/out filtering. For forwarding you need to add iptables rules in /etc/ufw/before.rules like here:

-A ufw-before-forward -i eth1 -p tcp -d --dport 22 -j ACCEPT

You probably already have a rule that lets connections from inside out and another that lets packets from related and established tcp sessions back in.

I'm no iptables specialist, it took me a very long time to figure this out (with ip6tables, but it should be similar). Maybe this is not all it takes in your case.

Best greetings

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.