2

I want to configure ufw firewall in a way, where I can allow "browser" surfing but deny all another outgoing.

I have denied outgoing using gufw but it blocked surfing too, so, I allowed "outgoing" anywhere http (80) and https (443), but was still not able to surf the internet.

Need help in setting up deny outgoing but still allow surfing internet with the browser.

3
  • Do you allow outgoing connection to DNS? – 2707974 Feb 12 '18 at 7:00
  • It's home PC. do i need to do that ? – user3767643 Feb 12 '18 at 7:39
  • Yes, you must. You PC use DNS to resolve logical name aka www.example.com to ip address. Without ip address for destination network traffic will not be router. – 2707974 Feb 12 '18 at 8:05
2

The first thing you need to do is to change the default outgoing policy to deny. By default all outgoing traffic is allowed.

sudo ufw default deny outgoing

Then you must allow outgoing traffic on both port 80 and 443 with these commands:

sudo ufw allow out to any port 80
sudo ufw allow out to any port 443

Finally, since web browsing require access to a DNS server you must also allow port 53:

sudo ufw allow out to any port 53

Then reload the firewall rules:

sudo ufw reload

Confirm the changes with: sudo ufw status verbose

enter image description here

4
  • Doesn't work , I just follow the exact rules mentioned above and I get the error "There is no Internet connection", so I was not able to write comment. After setting ALLOW to outgoing, I am having access to internet again. I am using "Google Chrome" and "firefox" as my browser. – user3767643 Apr 29 '18 at 9:40
  • Hm okay, it works on my machine that is a freshly installed Ubuntu 18.04 Desktop. Have you got an IP address if you run ifconfig? What are the result of "nslookup www.google.com"? – user822833 Apr 29 '18 at 11:07
  • If you take a look in /var/log/ufw.log, are there any rows that contain "[UFW BLOCK]" together with "DPT=53", "DPT=80" or "DPT=443"? Where DPT is the destination port number. – user822833 Apr 29 '18 at 11:12
  • 1
    Yes, I found there were some BLOCK and I realised, I did mistake, instead of ALLOW OUT, I did ALLOW IN and after fixing typo. It is working super fine. This is amazing. Thanks – user3767643 Apr 30 '18 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.