Creating/importing iptables rules to ufw

Question

Thank you very much for your time in reviewing my issue. I am currently trying to convert the following iptables to ufw:

iptables -A INPUT -p tcp -s 127.0.0.1 --destination-port 443 -j ACCEPT
iptables -A INPUT -p udp -s 127.0.0.1 --destination-port 80 -j ACCEPT
iptables -A INPUT -p udp -s 127.0.0.1 --destination-port 443 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp --destination-port 80 -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p udp --destination-port 443 -j REJECT --reject-with icmp-port-unreachable
ip6tables -A INPUT -p tcp -s ::1 --destination-port 443 -j ACCEPT
ip6tables -A INPUT -p udp -s ::1 --destination-port 80 -j ACCEPT
ip6tables -A INPUT -p udp -s ::1 --destination-port 443 -j ACCEPT
ip6tables -A INPUT -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
ip6tables -A INPUT -p udp --destination-port 80 -j REJECT --reject-with icmp6-port-unreachable
ip6tables -A INPUT -p udp --destination-port 443 -j REJECT --reject-with icmp6-port-unreachable

Currently, I have the following: /etc/ufw/before.rules (just after the "# End required lines")

-A ufw-before-input -p tcp -s 127.0.0.1 --destination-port 443 -j ACCEPT
-A ufw-before-input -p udp -s 127.0.0.1 --destination-port 80 -j ACCEPT
-A ufw-before-input -p udp -s 127.0.0.1 --destination-port 443 -j ACCEPT
-A ufw-before-input -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
-A ufw-before-input -p udp --destination-port 80 -j REJECT --reject-with icmp-port-unreachable
-A ufw-before-input -p udp --destination-port 443 -j REJECT --reject-with icmp-port-unreachable

/etc/ufw/before6.rules (just after the "# End required lines")

-A ufw6-before-input -p tcp -s ::1 --destination-port 443 -j ACCEPT
-A ufw6-before-input -p udp -s ::1 --destination-port 80 -j ACCEPT
-A ufw6-before-input -p udp -s ::1 --destination-port 443 -j ACCEPT
-A ufw6-before-input -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
-A ufw6-before-input -p udp --destination-port 80 -j REJECT --reject-with icmp6-port-unreachable
-A ufw6-before-input -p udp --destination-port 443 -j REJECT --reject-with icmp6-port-unreachable

I am monitoring the # of hits:

watch -n1 -d "iptables -vnxL | grep -v -e pkts -e Chain | sort -nk1 | tac | column -t | grep -E -- 'reject-with|127.0.0.1'"

I am accessing domains that should be triggering these reject rules, yet the counts are remaining 0.

If you are able to help me both figure out:

What am I doing wrong with my rules? Why am I not able to trigger them?

My experience and knowledge with iptables is very low. However I do have confidence in the traffic I am creating should be triggering these REJECT rules. They aren't even hitting my ACCEPT rules.

I am thinking I have messed up where/which chain I put the rules in.

Thank you so much, and please be safe out there <3

The output requested in the comments:

    root@TinkerBoardS:~ # sudo iptables -vnxL Chain INPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    6663   681990 ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    6663   681990 ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       1      328 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 2 packets, 80 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    6664   512047 ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    6664   512047 ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0
      38     3357 ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
       0        0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
       0        0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
       0        0 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
       1      328 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
       0        0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
       0        0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-after-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
       0        0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       6      360 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0            tcp dpt:443
       0        0 ACCEPT     udp  --  *      *       127.0.0.1            0.0.0.0/0            udp dpt:80
       0        0 ACCEPT     udp  --  *      *       127.0.0.1            0.0.0.0/0            udp dpt:443
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 reject-with tcp-reset
       0        0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 reject-with icmp-port-unreachable
       0        0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443 reject-with icmp-port-unreachable
    6496   489806 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
     121   180087 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
       0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
      40    11737 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
      40    11737 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination
    6502   490166 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
     124    18524 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
      38     3357 ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
    pkts      bytes target     prot opt in     out     source               destination
      23     9400 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
       3      174 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
      14     2163 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
       0        0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
    pkts      bytes target     prot opt in     out     source               destination
       1      328 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination
      17     1020 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW
      19     2257 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW

Chain ufw-user-forward (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       2      104 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 /* 'dapp_DNS' */
       1       63 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* 'dapp_DNS' */
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:115
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:82
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:82
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:444
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:444
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:445
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2295
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2295
      36    11242 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.1.0/24
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5355
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5355
       0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:853
       0        0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:853

Chain ufw-user-limit (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
       0        0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
    pkts      bytes target     prot opt in     out     source               destination

by "I am accessing domains that should be triggering these reject rules" are you saying you are trying to block your own outgoing access to external sites? I ask because your rules are for external people trying to access your web site (if you have one). — Doug Smythies, Apr 25 '20 at 3:26
I am trying to block certain traffic, yes. I am running PiHole DNS server, and trying to employ pi-hole.net/2018/02/02/… but via UFW I have tried all of the blocking modes listed docs.pi-hole.net/ftldns/blockingmode But, I can't trigger any of the above rules, neither the accepts, nor the rejects — p1r473, Apr 25 '20 at 4:21
Please edit your question adding your itpables rule set, the first part of your command, sudo iptables -vnxL. UFW generated iptables rule sets are difficult to follow, but O.K. — Doug Smythies, Apr 25 '20 at 5:59
The rules look O.K. to me. I did a bunch of studying, and now know why the rules are the way they are. How do you know that the pi-hole is identifying the site to block and therefore using this path? If you actually get the site on your computer, that is using the pi-hole as it DNS, then the pi-hole isn't detecting and blocking and giving you a 404 instead. Suggest tcpdump on the pi to prove it. — Doug Smythies, Apr 25 '20 at 14:51

p1r473 · Accepted Answer · 2020-04-26 19:46:48Z

0

Thank you SO MUCH Doug. You led me right to the answer. I reconfigured PiHole to respond with my local 192.168. address and it works now (I previously had it configured to respond with 127.0.01)

answered Apr 26 '20 at 19:46

p1r473

11 bronze badge

add a comment |

Stack Exchange Network

current community

your communities

more stack exchange communities

Creating/importing iptables rules to ufw

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged iptables firewall grep ufw or ask your own question.

Hot Network Questions

Creating/importing iptables rules to ufw

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged iptables firewall grep ufw or ask your own question.

Related

Hot Network Questions