I am running Ubuntu 11.04 (64 bits version) and would like to be able to get connected to the VPN server (CISCO) of my company. I am able to get connected to the VPN server when I disable UFW but, despite various attempts, I couldn't find the proper rules to enter in UFW in order to mediate this connection when UFW is enabled (Network-Manager keep on saying that my connection failed).

I have the following packages installed :

  • vpnc
  • network-manager-vpnc
  • network-manager-pptp
  • network-manager-pptp-gnome
  • network-manager-vpnc-gnome
  • pptp-linux

Here are my UFW rules :

443/tcp                    ALLOW       Anywhere
143                        ALLOW       Anywhere
Samba                      ALLOW       Anywhere
53,137,138/udp             ALLOW OUT   Anywhere
20,21,22,25,80,139,443,5900,8001/tcp ALLOW OUT   Anywhere
23399                      ALLOW OUT   Anywhere
19294/tcp                  ALLOW OUT   Anywhere
19295/udp                  ALLOW OUT   Anywhere
19302/udp                  ALLOW OUT   Anywhere
1863,5222,5223,6667,8010/tcp ALLOW OUT   Anywhere
6891:6900,6901/udp         ALLOW OUT   Anywhere
6891:6900,6901/tcp         ALLOW OUT   Anywhere
15399                      ALLOW OUT   Anywhere
5269/tcp                   ALLOW OUT   Anywhere
993/tcp                    ALLOW OUT   Anywhere
587/tcp                    ALLOW OUT   Anywhere
Anywhere                   DENY OUT    Anywhere  

While running 10.10 and Firestarter, I was able to get connected to the same VPN server after having entered the following lines in /etc/firestarter/user-pre :

iptables -A INPUT -j ACCEPT -s xxx.xxx.xx.xxx -p esp
iptables -A INPUT -j ACCEPT -s xxx.xxx.xx.xxx -p udp -m multiport --sports isakmp,10000
iptables -A INPUT -j ACCEPT -i tun+
iptables -A OUTPUT -j ACCEPT -d xxx.xxx.xx.xxx -p esp
iptables -A OUTPUT -j ACCEPT -d xxx.xxx.xx.xxx -p udp -m multiport --dports isakmp,10000
iptables -A OUTPUT -j ACCEPT -o tun+

(The xxx.xxx.xxx.xxx being replaced by my server's IP address)

Thus, what are the proper rules to enter in UFW to match the ones which used to work when running Firestarter as a firewall? More generally, which settings should I use in UFW to get the connection working ?

1 Answer 1


I can't believe it : I solved it !

These are the lines I added in /etc/ufw/before.rules :

-A ufw-before-input -s xxx.xxx.xxx.xxx -p esp -j ACCEPT 
-A ufw-before-input -s xxx.xxx.xxx.xxx -p udp -m multiport --sports isakmp,10000 -j ACCEPT 
-A ufw-before-input -i wlan0 -j ACCEPT 
-A ufw-before-output -d xxx.xxx.xxx.xxx -p esp -j ACCEPT 
-A ufw-before-output -d xxx.xxx.xxx.xxx -p udp -m multiport --sports isakmp,10000 -j ACCEPT 
-A ufw-before-output -o wlan0 -j ACCEPT

In my previous attempts, I made two mistakes :

  1. I copied some code from LibreOffice Writer to gedit and didn't notice that two dashes were replaced by a long dash using the autocorrection system.
  2. While firestarter needed to allow access (both as input and as output) to the "tun+" interface, ufw need this access to be allowed to the interface I use to contact the VPN server (wlan0 in my case).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.