Today, I listed my iptables for a routine check -- and discovered two strange UFW rules that I don't remember setting up myself, referring to two specific IP addresses that I can't identify:

-A ufw-before-input -d -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d -p udp -m udp --dport 1900 -j ACCEPT

This is kind of scary. Did someone manage to hack into my server and add these rules? If not, what happened?

(And if some malicious agent did hack into my firewall, why would they use ports 5353 and 1900, that aren't being forwarded by my router??)


Quoting man ufw:

       On installation, ufw is disabled with  a  default  incoming  policy  of
       deny,  a  default forward policy of deny, and a default outgoing policy
       of allow, with stateful tracking for NEW connections for  incoming  and
       forwarded  connections.  In addition to the above, a default ruleset is
       put in place that does the following:

       [ ... ]

       - ACCEPT mDNS (zeroconf/bonjour/avahi for IPv4 and ff02::fb
       for IPv6) for service discovery (INPUT)

       - ACCEPT UPnP ( for IPv4 and ff02::f for IPv6) for ser‐
       vice discovery (INPUT)

So these two rules you are seeing are part of ufw's default settings and allow mDNS and UPnP services to work.

| improve this answer | |
  • Aha! Right, I should have checked the manpage. Thanks for the clarification! – killer_rabbit Feb 11 '19 at 9:56

Googling says that those IP addresses are related to Simple Service Discovery Protocol (SSDP)/uPnP and iTunes. So it is likely that these rules are related to software you installed and relate to sharing information on a LAN. whois doesn't return any information for either IP.





| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.