I am having trouble understanding how SPT
and DPT
translate for outbound connections. When ufw
blocks a certain outbound connection, which is the port that needs to be unblocked and why.
For example, looking at this log string:
Feb 13 20:54:06 ubuntuvm kernel: [73952.037709] [UFW BLOCK] IN= OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=32199 DF PROTO=UDP SPT=68 DPT=67 LEN=308
Just the relevant parts for brevity:
... OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 ... SPT=68 DPT=67 ...
ubuntuvm
is 192.168.1.100
and my router is 192.168.1.1
and I understand the server is trying to update DHCP from the server.
So, based on this, my understanding is that 192.168.1.100:68
is trying to talk to 192.168.1.1:67
.
This would mean I would, on ubuntuvm
, allow out to port 68 (sudo ufw allow out 68
). I did this but it did not work. I had to allow out on port 67.
Can someone please explain this to me cause it doesn't make sense to me.
sudo ufw allow out [port]
. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?