Arch Linux

tea_niugnep

Member

Registered: 2021-02-16

Posts: 30

Why my ufw deny incoming didn't work?

I follow the wiki guide

ufw default deny

And I'm sure iptables and ip6tables service are disabled:

$ systemctl status iptables.service
○ iptables.service - IPv4 Packet Filtering Framework
     Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
     Active: inactive (dead)

$ systemctl status ip6tables.service
○ ip6tables.service - IPv6 Packet Filtering Framework
     Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; disabled; vendor preset: disabled)
     Active: inactive (dead)

And ufw status:

$ ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

I guess I should not able to connect to port80 and others, but I still can connect the internet by browser? Anything wrong with my ufw?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,238

Re: Why my ufw deny incoming didn't work?

I guess I should not able to connect to port80 and others, but I still can connect the internet by browser? Anything wrong with my ufw?

INcoming traffic is traffic that comes IN. (Ok, that was pointless :-)

You're perfectly able to connect OUTward on port 80 (http) or whatever.
The responses are then RELATED to an ESTABLISHED connection and I'd expect ufw to be smart enough to handle that correctly.

iptables -nvL

You should™ however not be able to access port 80 (or 22 or whatever) on the filtered system from the outside (that in includes the LAN but probably not the localhost)

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

tea_niugnep

Member

Registered: 2021-02-16

Posts: 30

Re: Why my ufw deny incoming didn't work?

I guess I should not able to connect to port80 and others, but I still can connect the internet by browser? Anything wrong with my ufw?

INcoming traffic is traffic that comes IN. (Ok, that was pointless :-)

You're perfectly able to connect OUTward on port 80 (http) or whatever.
The responses are then RELATED to an ESTABLISHED connection and I'd expect ufw to be smart enough to handle that correctly.

iptables -nvL

You should™ however not be able to access port 80 (or 22 or whatever) on the filtered system from the outside (that in includes the LAN but probably not the localhost)

oh..sorry. Now I know the web server use 80port and my browser use a random port so deny incoming doesn't work, right?
But I don't know by this way how to use firewall? I mean, for example, I don't want my computer establish a connection with a specific web server, but I dont' know what port my browser will use, so I can't prevent them connect?

progandy

Member

Registered: 2012-05-17

Posts: 5,321

Re: Why my ufw deny incoming didn't work?

If you know the IP of the server, then you can block connections to and from that, the source port on your computer is not important.
There is also a difference between incoming and outgoing. Incoming means connections that another server or computer started. Anything that your computer started (like opening a website) is handled as outgoing, even when data is returned to you by the server.

You cannot create an interactive desktop firewall that asks before each connection that way, though. If you really want that, maybe look at opensnitch.

Last edited by progandy (2021-11-06 15:32:19)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |

tea_niugnep

Member

Registered: 2021-02-16

Posts: 30

Re: Why my ufw deny incoming didn't work?

oh. Thanks! I think i got it