1

First, the errors, then the reasoning:

$ sudo ufw allow 22/tcp in on eno1 from 192.168.0.100 [sudo] password for robinadm: xxxx ERROR: Invalid interface clause

Hmm.... perhaps the "in" is redundant with the "from"?

$ sudo ufw allow 22/tcp on eno1 from 192.168.0.100 ERROR: Wrong number of arguments

Why the need for detail after a default of deny? I have two NICs, eno1 (= eth0) and eno2 (= eth1). The former is for specific inbound and outbound LAN communications, the latter will be for limited outbound-only WAN communications.

I want the rule to be very specific as to the access: port, NIC, which LAN system.

I do not want a cluster of rules that require vast amounts of if-then thinking, rather very specific rules that are all-in-one. I do not want to set the same for any system since there are 17 different OSs and/or OS versions.

Hence, I want to avoid over-simplifications; I just need to understand the correct format which will act as a template for many more. This one is a good example. If the format works as modules then it ought, in some way, work as integrated ones as well, which will be cleaner and easier to maintain whence it runs. I have found piecemeal explanations for each fragmented "piece" of this rule's logic, but see no full-integration logic or even examples anywhere.

I greatly appreciate your assistance in resolving the form so the rule parser stops choking w/o any concrete explanations like a compiler's parser outputs. Thanks.

  • Did you read man ufw? The part that says ufw [--dry-run] [delete] [insert NUM] allow|deny|reject|limit [in|out] [log|log-all] [PORT[/PROTOCOL] | APPNAME ] [comment COMMENT], and its explanation should help you. – waltinator Jan 4 at 4:53
  • Thanks waltinator. I had just reduced the complexity down to "$ sudo ufw allow proto tcp from 192.168.0.100 port 22" and the template rule was added. Naturally, the MacOSX side failed to access due to the usual [cr]Apple unseen, however, it's a good start. Thanks again. I still want to specify the NIC and am working on that aspect now. ;-) – frankfenderbender Jan 4 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.