1

I am running a vpn on my laptop. To ensure that traffic to and from the internet is only allowed through that vpn, I am running ufw with the following rules:

Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere on tun0           ALLOW IN    Anywhere                  
1194/udp                   ALLOW IN    Anywhere                  
192.168.1.0/24             ALLOW IN    192.168.1.0/24            
Anywhere (v6) on tun0      ALLOW IN    Anywhere (v6)             
1194/udp (v6)              ALLOW IN    Anywhere (v6)             

Anywhere                   ALLOW OUT   Anywhere on tun0          
1194/udp                   ALLOW OUT   Anywhere                  
192.168.1.0/24             ALLOW OUT   192.168.1.0/24            
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on tun0     
1194/udp (v6)              ALLOW OUT   Anywhere (v6)             

Now this works fine with one exception - I am unable to connect to octopi.local from my laptop without disabling the firewall. I can connect just fine through the direct IP address, but since that isn't a static address, that's not a reliable solution. How can I make sure that the octopi.local name is resolved through the firewall?

EDIT I found this page - ufw hostname resolution - and I tried the tail command, but I didn't really know what I was looking at. I did see "SPT=5353 DPT=5353" so I tried the "allow in 5353" command, but that didn't seem to help. Then I looked at my /etc/services file and found this:

hostmon     5355/tcp            # hostmon uses TCP (nocol)
hostmon     5355/udp            # hostmon uses UDP (nocol)

so I tried "allow in 5355". That still didn't allow ssh to resolve the hostname. I thought I'd let you know what I'd tried...

0

1 Answer 1

0

Thought I'd update this in case anyone else needs it. This is my final, working rule set for ufw that allow PIA VPN to connect automatically without disabling the firewall; allows communications between local networked computers; yet still denies all traffic outside the local network that does not go through the VPN tunnel:

To                         Action      From
--                         ------      ----
Anywhere on tun0           ALLOW       Anywhere                  
1194/udp                   ALLOW       Anywhere                  
192.168.1.0/24             ALLOW       192.168.1.0/24            
5353                       ALLOW       Anywhere                  
Anywhere (v6) on tun0      ALLOW       Anywhere (v6)             
1194/udp (v6)              ALLOW       Anywhere (v6)             
5353 (v6)                  ALLOW       Anywhere (v6)             
Anywhere                   ALLOW OUT   Anywhere on tun0          
1194/udp                   ALLOW OUT   Anywhere                  
192.168.1.0/24             ALLOW OUT   192.168.1.0/24            
5353                       ALLOW OUT   Anywhere                  
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on tun0     
1194/udp (v6)              ALLOW OUT   Anywhere (v6)             
5353 (v6)                  ALLOW OUT   Anywhere (v6)             

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .