what port should be allowed in ufw to allow specific outbound traffic and why - SPT vs DPT
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
I am having trouble understanding how SPT and DPT translate for outbound connections. When ufw blocks a certain outbound connection, which is the port that needs to be unblocked and why.
For example, looking at this log string:
Feb 13 20:54:06 ubuntuvm kernel: [73952.037709] [UFW BLOCK] IN= OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=32199 DF PROTO=UDP SPT=68 DPT=67 LEN=308
Just the relevant parts for brevity:
... OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 ... SPT=68 DPT=67 ...
ubuntuvm is 192.168.1.100 and my router is 192.168.1.1 and I understand the server is trying to update DHCP from the server.
So, based on this, my understanding is that 192.168.1.100:68 is trying to talk to 192.168.1.1:67.
This would mean I would, on ubuntuvm, allow out to port 68 (sudo ufw allow out 68). I did this but it did not work. I had to allow out on port 67.
Can someone please explain this to me cause it doesn't make sense to me.
networking server firewall ufw
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
add a comment |
I am having trouble understanding how SPT and DPT translate for outbound connections. When ufw blocks a certain outbound connection, which is the port that needs to be unblocked and why.
For example, looking at this log string:
Feb 13 20:54:06 ubuntuvm kernel: [73952.037709] [UFW BLOCK] IN= OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=32199 DF PROTO=UDP SPT=68 DPT=67 LEN=308
Just the relevant parts for brevity:
... OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 ... SPT=68 DPT=67 ...
ubuntuvm is 192.168.1.100 and my router is 192.168.1.1 and I understand the server is trying to update DHCP from the server.
So, based on this, my understanding is that 192.168.1.100:68 is trying to talk to 192.168.1.1:67.
This would mean I would, on ubuntuvm, allow out to port 68 (sudo ufw allow out 68). I did this but it did not work. I had to allow out on port 67.
Can someone please explain this to me cause it doesn't make sense to me.
networking server firewall ufw
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP.
– Doug Smythies
Feb 14 at 19:06
Okay. I will do it tonight. The commands were basicallysudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?
– IMTheNachoMan
Feb 14 at 19:22
add a comment |
I am having trouble understanding how SPT and DPT translate for outbound connections. When ufw blocks a certain outbound connection, which is the port that needs to be unblocked and why.
For example, looking at this log string:
Feb 13 20:54:06 ubuntuvm kernel: [73952.037709] [UFW BLOCK] IN= OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=32199 DF PROTO=UDP SPT=68 DPT=67 LEN=308
Just the relevant parts for brevity:
... OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 ... SPT=68 DPT=67 ...
ubuntuvm is 192.168.1.100 and my router is 192.168.1.1 and I understand the server is trying to update DHCP from the server.
So, based on this, my understanding is that 192.168.1.100:68 is trying to talk to 192.168.1.1:67.
This would mean I would, on ubuntuvm, allow out to port 68 (sudo ufw allow out 68). I did this but it did not work. I had to allow out on port 67.
Can someone please explain this to me cause it doesn't make sense to me.
networking server firewall ufw
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
I am having trouble understanding how SPT and DPT translate for outbound connections. When ufw blocks a certain outbound connection, which is the port that needs to be unblocked and why.
For example, looking at this log string:
Feb 13 20:54:06 ubuntuvm kernel: [73952.037709] [UFW BLOCK] IN= OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=32199 DF PROTO=UDP SPT=68 DPT=67 LEN=308
Just the relevant parts for brevity:
... OUT=enp0s3 SRC=192.168.1.100 DST=192.168.1.1 ... SPT=68 DPT=67 ...
ubuntuvm is 192.168.1.100 and my router is 192.168.1.1 and I understand the server is trying to update DHCP from the server.
So, based on this, my understanding is that 192.168.1.100:68 is trying to talk to 192.168.1.1:67.
This would mean I would, on ubuntuvm, allow out to port 68 (sudo ufw allow out 68). I did this but it did not work. I had to allow out on port 67.
Can someone please explain this to me cause it doesn't make sense to me.
networking server firewall ufw
networking server firewall ufw
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
asked Feb 14 at 2:53
IMTheNachoManIMTheNachoMan
267212
267212
Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP.
– Doug Smythies
Feb 14 at 19:06
Okay. I will do it tonight. The commands were basicallysudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?
– IMTheNachoMan
Feb 14 at 19:22
add a comment |
Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP.
– Doug Smythies
Feb 14 at 19:06
Okay. I will do it tonight. The commands were basicallysudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?
– IMTheNachoMan
Feb 14 at 19:22
Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP.
– Doug Smythies
Feb 14 at 19:06
Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP.
– Doug Smythies
Feb 14 at 19:06
Okay. I will do it tonight. The commands were basically
sudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?– IMTheNachoMan
Feb 14 at 19:22
Okay. I will do it tonight. The commands were basically
sudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?– IMTheNachoMan
Feb 14 at 19:22
add a comment |
1 Answer
1
active
oldest
votes
UFW is just a front end for iptables.
The command sudo ufw allow out 68 results in these iptables rules:
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68
which is not what you actually want, because your source port (SPT) is 68 and the destination port (DPT) is 67.
To be rigorous, suggest that what you really want is:
sudo ufw allow out proto udp from 192.168.1.100 port 68 to 192.168.1.1 port 67
resulting in (I use this command: sudo iptables -v -x -n -L):
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 192.168.1.100 192.168.1.1 udp spt:68 dpt:67
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1118093%2fwhat-port-should-be-allowed-in-ufw-to-allow-specific-outbound-traffic-and-why%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
UFW is just a front end for iptables.
The command sudo ufw allow out 68 results in these iptables rules:
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68
which is not what you actually want, because your source port (SPT) is 68 and the destination port (DPT) is 67.
To be rigorous, suggest that what you really want is:
sudo ufw allow out proto udp from 192.168.1.100 port 68 to 192.168.1.1 port 67
resulting in (I use this command: sudo iptables -v -x -n -L):
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 192.168.1.100 192.168.1.1 udp spt:68 dpt:67
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
add a comment |
UFW is just a front end for iptables.
The command sudo ufw allow out 68 results in these iptables rules:
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68
which is not what you actually want, because your source port (SPT) is 68 and the destination port (DPT) is 67.
To be rigorous, suggest that what you really want is:
sudo ufw allow out proto udp from 192.168.1.100 port 68 to 192.168.1.1 port 67
resulting in (I use this command: sudo iptables -v -x -n -L):
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 192.168.1.100 192.168.1.1 udp spt:68 dpt:67
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
add a comment |
UFW is just a front end for iptables.
The command sudo ufw allow out 68 results in these iptables rules:
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68
which is not what you actually want, because your source port (SPT) is 68 and the destination port (DPT) is 67.
To be rigorous, suggest that what you really want is:
sudo ufw allow out proto udp from 192.168.1.100 port 68 to 192.168.1.1 port 67
resulting in (I use this command: sudo iptables -v -x -n -L):
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 192.168.1.100 192.168.1.1 udp spt:68 dpt:67
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
UFW is just a front end for iptables.
The command sudo ufw allow out 68 results in these iptables rules:
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68
which is not what you actually want, because your source port (SPT) is 68 and the destination port (DPT) is 67.
To be rigorous, suggest that what you really want is:
sudo ufw allow out proto udp from 192.168.1.100 port 68 to 192.168.1.1 port 67
resulting in (I use this command: sudo iptables -v -x -n -L):
Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 192.168.1.100 192.168.1.1 udp spt:68 dpt:67
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
answered Feb 14 at 22:17
Doug SmythiesDoug Smythies
7,45631631
7,45631631
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1118093%2fwhat-port-should-be-allowed-in-ufw-to-allow-specific-outbound-traffic-and-why%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Please edit your question and add the ufw commands you entered. when you say "allow out to port 68" and "allow out on port 67" you are saying basically the same thing. Anyway for DHCP you need to allow the SPT (Source Port) 68 to access 192.168.1.1 DST (Destination Port) 67 protocol UDP.
– Doug Smythies
Feb 14 at 19:06
Okay. I will do it tonight. The commands were basically
sudo ufw allow out [port]. and they are basically the same thing but different ports. so the question is, even after I allowed 68 out, how come DHCP didn't work ?– IMTheNachoMan
Feb 14 at 19:22