Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having problems configuring the uncomplicated firewall (ufw) to allow outgoing multicast traffic. I am blocking all in and outgoing connections as the default policy. I have supplemented with the rules listed below. Yet, I get these error messages repeated twice after every time I boot the system:

Errors (repeated twice on boot-up):


[UFW BLOCK] IN= OUT=eth0 SRC=fe80:0000:0000:0000:f66d:feee:feee:feee DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=56 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0

[UFW BLOCK] IN= OUT=eth0 SRC=fe80:0000:0000:0000:f66d:04ff:feee:df54 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0

Main rules:

ufw allow out proto udp to
ufw allow out proto udp to ff00::/8
ufw allow in  proto udp to
ufw allow in  proto udp to ff00::/8


-A ufw-before-input  -p igmp -d -j ACCEPT
-A ufw-before-output -p igmp -d -j ACCEPT

and in

-A ufw6-before-input  -p icmpv6 -d ff00::/8 -j ACCEPT
-A ufw6-before-output -p icmpv6 -d ff00::/8 -j ACCEPT
share|improve this question
Please note that the multicast range is not It is because the addresses from up are not multicast. – ssb Apr 1 '14 at 18:38


I think that this numbers must be within of the number ff00::/8. I don't know if them are.

Or maybe you want to try "My UPnP player can not see MediaTomb, what is wrong?"'s rules. Though them be for a necessity that seems the inverse...

share|improve this answer

I have seen similar messages in the log an did the following:



I added

\# allow igmp codes from my local sub-net
-A ufw-before-input -p igmp -m ttl --ttl-eq 1 -j ACCEPT

and to


\# allow multicast group membership maintenance
-A ufw6-before-output -p icmpv6 --icmpv6-type 130 -m hl --hl-eq 1 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type 131 -m hl --hl-eq 1 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type 132 -m hl --hl-eq 1 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type 143 -m hl --hl-eq 1 -j ACCEPT


\# allow multicast group membership maintenance go in as well
-A ufw6-before-input -p icmpv6 --icmpv6-type 130 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type 131 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type 132 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type 143 -j ACCEPT

Note however that the messages blocked where group membership queries from the local router, i have no actual programm running that use IP multicast at all. But the log entries are gone after all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.