1

I am having trouble understanding how SPT and DPT translate for outbound connections. When ufw blocks a certain outbound connection, which is the port that needs to be unblocked and why.

For example, looking at this log string:

Feb 13 20:54:06 ubuntuvm kernel: [73952.037709] [UFW BLOCK] IN= OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=32199 DF PROTO=UDP SPT=68 DPT=67 LEN=308

Just the relevant parts for brevity:

... OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 ... SPT=68 DPT=67 ...

ubuntuvm is 192.168.1.100 and my router is 192.168.1.1 and I understand the server is trying to update DHCP from the server.

So, based on this, my understanding is that 192.168.1.100:68 is trying to talk to 192.168.1.1:67.

This would mean I would, on ubuntuvm, allow out to port 68 (sudo ufw allow out 68). I did this but it did not work. I had to allow out on port 67.

Can someone please explain this to me cause it doesn't make sense to me.

2
  • Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP. Feb 14, 2019 at 19:06
  • Okay. I will do it tonight. The commands were basically sudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ? Feb 14, 2019 at 19:22

1 Answer 1

0

UFW is just a front end for iptables. The command sudo ufw allow out 68 results in these iptables rules:

Chain ufw-user-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:68
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68

which is not what you actually want, because your source port (SPT) is 68 and the destination port (DPT) is 67.

To be rigorous, suggest that what you really want is:

sudo ufw allow out proto udp from 192.168.1.100 port 68 to 192.168.1.1 port 67

resulting in (I use this command: sudo iptables -v -x -n -L):

Chain ufw-user-output (1 references)
pkts      bytes target     prot opt in     out     source               destination
   0        0 ACCEPT     udp  --  *      *       192.168.1.100        192.168.1.1          udp spt:68 dpt:67

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .