Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is my status:

$ sudo ufw status verbose
Status: active
Logging: on (medium)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere

All outgoing flow are allowed. Now when I am doing:

$ wget
--2013-07-30 14:28:00--
Resolving failed: Name or service not known.
wget: unable to resolve host address `'

What I see in /var/log/kern.log is that the traffic is, indeed, blocked:

Jul 30 14:11:27 XXXXXX kernel: [2207680.256415] [UFW BLOCK] IN=lo OUT= MAC=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=62240 DF PROTO=UDP SPT=35323 DPT=53 LEN=40 

Here is my ufw version:

$ sudo ufw version
ufw 0.29.3-1
Copyright 2008-2009 Canonical Ltd.

Is explicitly allowing outgoing traffic not enough? How to solve that? Should I add a rule for allowing the loopback interface? How to do that?

share|improve this question

You need to allow established traffic back in.

At the moment your machine is trying to do a DNS lookup for but it is never getting the result as the traffic back from the DNS server is being blocked.

share|improve this answer
shouldn't that (as well as loopback traffic) be handled by the default before.rules file though? at least that's how it seems to be in ufw 0.31.1-1 – steeldriver Jul 30 '13 at 18:09
This answer reiterates the problem and doesn't actually answer the question of HOW. I'm also looking for the answer to this – Neil C. Obremski Nov 11 '13 at 22:04

This command helps me solve the issue sudo ufw allow 53/udp. Port 53 is the port for DNS.

share|improve this answer
The OP's error does indicate that DNS lookups are failing, although I doubt the underlying cause is a firewall rule. – Nathan Osman Nov 20 '15 at 9:55
@DavidFoerster they are, read the kernel message. – guntbert Nov 20 '15 at 21:39
Ah, sorry. I overlooked the DTP=53. – David Foerster Nov 20 '15 at 22:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.