1

I'm trying to configure ufw to only allow connections to 3 ip addresses on my local network, and deny everything else. Here's the commands I'm using:

yes | sudo ufw reset

sudo ufw default deny

sudo ufw allow in from 192.168.11.109
sudo ufw allow in from 192.168.11.118
sudo ufw allow in from 192.168.11.212

sudo ufw allow out to 192.168.11.109
sudo ufw allow out to 192.168.11.118
sudo ufw allow out to 192.168.11.212

sudo ufw enable

sudo ufw status verbose

Everything seems to work. Here's the result of the status command:

joel@walker11 ~> sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW IN    192.168.11.109
Anywhere                   ALLOW IN    192.168.11.118
Anywhere                   ALLOW IN    192.168.11.212

192.168.11.109             ALLOW OUT   Anywhere
192.168.11.118             ALLOW OUT   Anywhere
192.168.11.212             ALLOW OUT   Anywhere

However, I cannot ping any of those ip addresses that I explicitly allowed:

joel@walker11 ~> ping 192.168.11.109
PING 192.168.11.109 (192.168.11.109) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 192.168.11.109 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1007ms

How can I setup my firewall to allow traffic to/from those ip addresses?

7
  • Check your icmp rules in /etc/ufw/before.rules, also, check after.rules, same directory to see if icmp lines are set to "ACCEPT"
    – RCF
    Jun 28, 2014 at 22:07
  • @RCF-U14.04 All icmp lines in before.rules are set to ACCEPT, and after.rules doesn't have any icmp lines. Should it?
    – Joel
    Jun 28, 2014 at 22:33
  • I would not change after.rules. I don't know if this will help, but try your ping as sudo. Are you going through a router that uses NAT?
    – RCF
    Jun 28, 2014 at 22:50
  • Hmm, sudo ping isn't any different. And yes, the router uses NAT.
    – Joel
    Jun 29, 2014 at 20:29
  • Using UFW with default settings, I can ping all devices on my network and I am using a NAT enabled router. Default settings deny all incoming and allow all outgoing, but allow icmp. Do you have any rules set up on your router? If so, they may be conflicting with your UFW.
    – RCF
    Jun 29, 2014 at 20:56

0

You must log in to answer this question.

Browse other questions tagged .