0

I have an issue I've been trying to solve for a few days now - I'm working on a relatively fresh installation of Ubuntu 18.04, I enabled UFW and configured it with the following rules.

sudo ufw status verbose 
Status: active Logging: on (low) Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip



1.1.1.1 53/udp             ALLOW OUT   Anywhere on < interface >        
1.1.1.1 53/tcp             ALLOW OUT   Anywhere on < interface >       
80/tcp                     ALLOW OUT   Anywhere on < interface >         
443/tcp                    ALLOW OUT   Anywhere on < interface >         
1194/udp                   ALLOW OUT   Anywhere on < interface >         
500/tcp                    ALLOW OUT   Anywhere on < interface >         
500/udp                    ALLOW OUT   Anywhere on < interface >         
4500/udp                   ALLOW OUT   Anywhere on < interface >         
8.8.8.8 53/udp             ALLOW OUT   Anywhere on < interface >         
8.8.4.4 53/udp             ALLOW OUT   Anywhere on < interface >         
80/tcp (v6)                ALLOW OUT   Anywhere (v6) on < interface >    
443/tcp (v6)               ALLOW OUT   Anywhere (v6) on < interface >    
1194/udp (v6)              ALLOW OUT   Anywhere (v6) on < interface >    
500/tcp (v6)               ALLOW OUT   Anywhere (v6) on < interface >    
500/udp (v6)               ALLOW OUT   Anywhere (v6) on < interface >    
4500/udp (v6)              ALLOW OUT   Anywhere (v6) on < interface >    

This UFW config seems to work fine, when using 1.1.1.1 or 8.8.8.8 as my DNS ping to the DNS and to domains (usually google.com) both are successful.

After I finished setting up UFW I moved onto installing OpenVPN to connect to ProtonVPN servers - this is when my DNS problem begun.

When the VPN is connected with UFW DISABLED a ping to google.com will resolve and work.

But when the VPN is connected and UFW is ENABLED a ping to google will NOT resolve.

I've tried using 1.1.1.1 and 8.8.8.8 as my DNS and the problem persists with both.

Does anybody have any ideas on what may be going wrong? I beleive the issue lies within my UFW config but I can't see where.

2 Answers 2

0

Here's my guess:

  • By default, the VPN tunnel will usually supply its own DNS resolver as part of it's DHCP config. In the case of ProtonVPN, I believe these are internal 10.x.x.x addresses. I think what's happening is that whatever DNS servers are being supplied are not part of your UFW whitelist for port 53, so when you connect to ProtonVPN, the DNS server is changed to one that isn't on your whitelist, and the traffic cant get out.

I've never done it before, but it looks like you can override the DNS config by adding:

script-security 2
push "dhcp-option DNS 1.1.1.1"

To your OpenVPN configuration file for ProtonVPN.

2
  • That makes alot of sense!! I just checked my DNS with UFW disabled and connected to the VPN, its primary showed as 10.x.x.x - Looks like that could be causing the issue alright, I've allowed all outbound on UDP 53 to test but the issue still persists, I'll make the OpenVPN Conf edits you mentioned and see if that works.. Thanks!
    – b4kku
    Jul 11, 2018 at 22:20
  • 1
    Problem still persists, I made the changes you specified and my DNS is still showing as 10.x.x.x on the VPN gateway!
    – b4kku
    Jul 11, 2018 at 22:35
0

Issue solved, said I'd post what fixed it for me incase anyone else runs into the same issue.

Really simple fix in hindsight.

I failed to recognise that the VPN interface required its own rules in UFW to contact the ProtonVPN DNS server - so I added this rule.

10.8.0.1 53/tcp    ALLOW OUT    Anywhere on < VPN Interface >

This rule allowed me to ping 8.8.8.8, 10.8.0.1 AND google.com whislt the VPN was connected and UFW enabled - but I could access pages via browser.

To fix that I then added the following rules -

80/tcp            ALLOW OUT    Anywhere on < VPN Interface >
443/tcp           ALLOW OUT    Anywhere on < VPN Interface >

Everythings working fine now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .