On my Ubuntu 16.04 machine, I have configured UFW like this:
$ sudo apt-get install ufw $ sudo ufw limit 22/tcp $ sudo ufw allow 80/tcp $ sudo ufw allow 443/tcp $ sudo ufw enable
Now if I run
sudo ufw status verbose, the output is the following:
Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- 22/tcp LIMIT IN Anywhere 80/tcp ALLOW IN Anywhere 443/tcp ALLOW IN Anywhere 22/tcp (v6) LIMIT IN Anywhere (v6) 80/tcp (v6) ALLOW IN Anywhere (v6) 443/tcp (v6) ALLOW IN Anywhere (v6)
Which looks good, as far as I can see: It allows SSH (throttled) and also HTTP and HTTPS. Which is what was desired.
But after a few days, looking into
/var/log/ufw.log reveals quite a few entries like the following examples:
Jan 1 00:00:00 <SERVER_NAME> kernel: [<UPTIME>] [UFW BLOCK] IN=eth0 OUT= MAC=<41_CHARACTERS> SRC=<IP_V4> DST=<IP_V4> LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=1234 DF PROTO=TCP SPT=17708 DPT=443 WINDOW=0 RES=0x00 RST URGP=0 Jan 2 23:59:59 <SERVER_NAME> kernel: [<UPTIME>] [UFW BLOCK] IN=eth0 OUT= MAC=<41_CHARACTERS> SRC=<IP_V4> DST=<IP_V4> LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=23456 DF PROTO=TCP SPT=29199 DPT=443 WINDOW=1061 RES=0x00 ACK FIN URGP=0
DPT=443, is UFW blocking some HTTPS requests? Why is that? HTTPS (i.e. port 443 via TCP) is explicitly allowed in the UFW configuration, as seen above, isn’t it? What other reasons could there be for UFW to block these requests?
(UFW clearly doesn’t block all HTTPS requests, as I can open my website via HTTPS in the browser when I try it.)