1

I recently had the following conflicting rules on ufw

445/tcp ALLOW 192.168.1.0/24

445 DENY anywhere

445 DENY anywhere IPV6

because I first blocked the 445 to then allow it only on my subnet. I was doing that as part of the samba configuration on my local network and I noticed that such conflicting rules did not impact some of my devices (2 pcs and a playstation connecting to the samba server) but impacted an android phone connecting to the server.

I could do some tests here to try to infer how does ufw handle those "conflicting rules", however I though I would probably get a more accurate answer here =D

Does ufw overwrite the ALLOWS on top of the DENYs? Or how does it handle those type of conflicts?

4

ufw does not "handle the conflicts" in any way, it just puts the rules into an iptables chain which follows the first-match policy.

So if a packet matches a rule which drops it, it will be dropped regardless of any other matching rules which may follow.

  • does that mean that the drop rule overwrite the allow rule? Or it is really by the order in which the rule has been added, so if I first add an allow and then a deny, it will allow? – Thomas Jul 23 '13 at 21:16
  • a) It doesn't "overwrite" it, it is just executed and no other rules are examined. b) yes. BTW: in ufw you can use the insert keyword to insert rules anywhere in the ruleset. – arrange Jul 23 '13 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.