Should ufw block access to localhost?

Colin Law clanlaw at gmail.com
Thu Mar 14 17:13:20 UTC 2019


On Thu, 14 Mar 2019 at 16:03, Colin Law <clanlaw at gmail.com> wrote:
>
> Sorry, I have just realised that I mis-interpreted what was going on.
> The port is not, in fact, blocked to localhost but when I try to
> connect to mosquitto from localhost then it takes about 60 seconds to
> connect if ufw is enabled.  If ufw is disabled then it connects
> immediately.  Using tcpdump I can see that during that minute there
> are a dozen or so messages backwards and forwards before it connects.
> But I am none the wiser as to what is going on.
>
> If instead of trying to connect on localhost I tell it to connect
> using its own IP address then it works perfectly.

I presume that some of the messages must be getting blocked by
IPtables, but the process recovers somehow after a timeout.  Here are
the results of the commands suggested.

--------------------
sudo iptables --line-numbers -nvxL
Chain INPUT (policy DROP 2 packets, 80 bytes)
num      pkts      bytes target     prot opt in     out     source
          destination
1       45002  4130182 f2b-sshd   tcp  --  *      *       0.0.0.0/0
        0.0.0.0/0            multiport dports 22
2      965409 104683856 ufw-before-logging-input  all  --  *      *
   0.0.0.0/0            0.0.0.0/0
3      965409 104683856 ufw-before-input  all  --  *      *
0.0.0.0/0            0.0.0.0/0
4      409855 26588193 ufw-after-input  all  --  *      *
0.0.0.0/0            0.0.0.0/0
5      408089 26500007 ufw-after-logging-input  all  --  *      *
 0.0.0.0/0            0.0.0.0/0
6      408089 26500007 ufw-reject-input  all  --  *      *
0.0.0.0/0            0.0.0.0/0
7      408089 26500007 ufw-track-input  all  --  *      *
0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ufw-before-logging-forward  all  --  *      *
    0.0.0.0/0            0.0.0.0/0
2           0        0 ufw-before-forward  all  --  *      *
0.0.0.0/0            0.0.0.0/0
3           0        0 ufw-after-forward  all  --  *      *
0.0.0.0/0            0.0.0.0/0
4           0        0 ufw-after-logging-forward  all  --  *      *
   0.0.0.0/0            0.0.0.0/0
5           0        0 ufw-reject-forward  all  --  *      *
0.0.0.0/0            0.0.0.0/0
6           0        0 ufw-track-forward  all  --  *      *
0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source
          destination
1      670688 283408496 ufw-before-logging-output  all  --  *      *
    0.0.0.0/0            0.0.0.0/0
2      670688 283408496 ufw-before-output  all  --  *      *
0.0.0.0/0            0.0.0.0/0
3       45647 25682386 ufw-after-output  all  --  *      *
0.0.0.0/0            0.0.0.0/0
4       45647 25682386 ufw-after-logging-output  all  --  *      *
  0.0.0.0/0            0.0.0.0/0
5       45647 25682386 ufw-reject-output  all  --  *      *
0.0.0.0/0            0.0.0.0/0
6       45647 25682386 ufw-track-output  all  --  *      *
0.0.0.0/0            0.0.0.0/0

Chain f2b-sshd (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 REJECT     all  --  *      *
194.190.78.195       0.0.0.0/0            reject-with
icmp-port-unreachable
2           0        0 REJECT     all  --  *      *
51.75.120.244        0.0.0.0/0            reject-with
icmp-port-unreachable
3           0        0 REJECT     all  --  *      *
128.199.50.209       0.0.0.0/0            reject-with
icmp-port-unreachable
4           0        0 REJECT     all  --  *      *
58.68.255.251        0.0.0.0/0            reject-with
icmp-port-unreachable
5           0        0 REJECT     all  --  *      *
211.24.250.143       0.0.0.0/0            reject-with
icmp-port-unreachable
6           0        0 REJECT     all  --  *      *
111.230.38.241       0.0.0.0/0            reject-with
icmp-port-unreachable
7       38517  3625254 RETURN     all  --  *      *       0.0.0.0/0
        0.0.0.0/0

Chain ufw-after-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-after-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ufw-skip-to-policy-input  udp  --  *      *
  0.0.0.0/0            0.0.0.0/0            udp dpt:137
2           0        0 ufw-skip-to-policy-input  udp  --  *      *
  0.0.0.0/0            0.0.0.0/0            udp dpt:138
3           2      120 ufw-skip-to-policy-input  tcp  --  *      *
  0.0.0.0/0            0.0.0.0/0            tcp dpt:139
4          61     3020 ufw-skip-to-policy-input  tcp  --  *      *
  0.0.0.0/0            0.0.0.0/0            tcp dpt:445
5           0        0 ufw-skip-to-policy-input  udp  --  *      *
  0.0.0.0/0            0.0.0.0/0            udp dpt:67
6           0        0 ufw-skip-to-policy-input  udp  --  *      *
  0.0.0.0/0            0.0.0.0/0            udp dpt:68
7           0        0 ufw-skip-to-policy-input  all  --  *      *
  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type
BROADCAST

Chain ufw-after-logging-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all  --  *      *       0.0.0.0/0
        0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1         197    15795 LOG        all  --  *      *       0.0.0.0/0
        0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-after-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-before-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate RELATED,ESTABLISHED
2           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 3
3           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 4
4           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 11
5           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 12
6           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 8
7           0        0 ufw-user-forward  all  --  *      *
0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1        2099   675322 ACCEPT     all  --  lo     *       0.0.0.0/0
        0.0.0.0/0
2       23578  3365159 ACCEPT     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate RELATED,ESTABLISHED
3          78     3595 ufw-logging-deny  all  --  *      *
0.0.0.0/0            0.0.0.0/0            ctstate INVALID
4          78     3595 DROP       all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate INVALID
5           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 3
6           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 4
7           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 11
8           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 12
9          45     3574 ACCEPT     icmp --  *      *       0.0.0.0/0
        0.0.0.0/0            icmptype 8
10          0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        0.0.0.0/0            udp spt:67 dpt:68
11     123038  7385982 ufw-not-local  all  --  *      *
0.0.0.0/0            0.0.0.0/0
12          0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        224.0.0.251          udp dpt:5353
13          0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        239.255.255.250      udp dpt:1900
14     123038  7385982 ufw-user-input  all  --  *      *
0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-before-logging-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-before-logging-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-before-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1        2099   675322 ACCEPT     all  --  *      lo      0.0.0.0/0
        0.0.0.0/0
2       27574  8720485 ACCEPT     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate RELATED,ESTABLISHED
3         191    13551 ufw-user-output  all  --  *      *
0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all  --  *      *       0.0.0.0/0
        0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1          73     3395 RETURN     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
2           5      200 LOG        all  --  *      *       0.0.0.0/0
        0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1      123038  7385982 RETURN     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ADDRTYPE match dst-type LOCAL
2           0        0 RETURN     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
3           0        0 RETURN     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
4           0        0 ufw-logging-deny  all  --  *      *
0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
5           0        0 DROP       all  --  *      *       0.0.0.0/0
        0.0.0.0/0

Chain ufw-reject-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-reject-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-reject-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-skip-to-policy-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 DROP       all  --  *      *       0.0.0.0/0
        0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1          63     3140 DROP       all  --  *      *       0.0.0.0/0
        0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all  --  *      *       0.0.0.0/0
        0.0.0.0/0

Chain ufw-track-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-track-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-track-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1          24     2256 ACCEPT     tcp  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate NEW
2         145     9703 ACCEPT     udp  --  *      *       0.0.0.0/0
        0.0.0.0/0            ctstate NEW

Chain ufw-user-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-user-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1          82     4900 ACCEPT     tcp  --  *      *       0.0.0.0/0
        0.0.0.0/0            tcp dpt:22
2           0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        0.0.0.0/0            udp dpt:22
3          10      500 ACCEPT     tcp  --  *      *       0.0.0.0/0
        0.0.0.0/0            tcp dpt:80
4           0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        0.0.0.0/0            udp dpt:80
5        2279   137247 ACCEPT     tcp  --  *      *       0.0.0.0/0
        0.0.0.0/0            tcp dpt:443
6           0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        0.0.0.0/0            udp dpt:443
7           3      180 ACCEPT     tcp  --  *      *       0.0.0.0/0
        0.0.0.0/0            tcp dpt:8883
8           0        0 ACCEPT     udp  --  *      *       0.0.0.0/0
        0.0.0.0/0            udp dpt:8883

Chain ufw-user-limit (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all  --  *      *       0.0.0.0/0
        0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0
level 4 prefix "[UFW LIMIT BLOCK] "
2           0        0 REJECT     all  --  *      *       0.0.0.0/0
        0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all  --  *      *       0.0.0.0/0
        0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-user-logging-input (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-user-logging-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw-user-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

-------------
and
sudo ip6tables --line-numbers -nvxL
Chain INPUT (policy DROP 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-after-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-after-input (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ufw6-skip-to-policy-input  udp      *      *
   ::/0                 ::/0                 udp dpt:137
2           0        0 ufw6-skip-to-policy-input  udp      *      *
   ::/0                 ::/0                 udp dpt:138
3           0        0 ufw6-skip-to-policy-input  tcp      *      *
   ::/0                 ::/0                 tcp dpt:139
4           0        0 ufw6-skip-to-policy-input  tcp      *      *
   ::/0                 ::/0                 tcp dpt:445
5           0        0 ufw6-skip-to-policy-input  udp      *      *
   ::/0                 ::/0                 udp dpt:546
6           0        0 ufw6-skip-to-policy-input  udp      *      *
   ::/0                 ::/0                 udp dpt:547

Chain ufw6-after-logging-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all      *      *       ::/0
        ::/0                 limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW BLOCK] "

Chain ufw6-after-logging-input (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all      *      *       ::/0
        ::/0                 limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW BLOCK] "

Chain ufw6-after-logging-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-after-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-before-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 DROP       all      *      *       ::/0
        ::/0                 rt type:0
2           0        0 ACCEPT     all      *      *       ::/0
        ::/0                 ctstate RELATED,ESTABLISHED
3           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 1
4           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 2
5           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 3
6           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 4
7           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 128
8           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 129
9           0        0 ufw6-user-forward  all      *      *       ::/0
                ::/0

Chain ufw6-before-input (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all      lo     *       ::/0
        ::/0
2           0        0 DROP       all      *      *       ::/0
        ::/0                 rt type:0
3           0        0 ACCEPT     all      *      *       ::/0
        ::/0                 ctstate RELATED,ESTABLISHED
4           0        0 ufw6-logging-deny  all      *      *       ::/0
                ::/0                 ctstate INVALID
5           0        0 DROP       all      *      *       ::/0
        ::/0                 ctstate INVALID
6           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 1
7           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 2
8           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 3
9           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 4
10          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 128
11          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 129
12          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 133 HL match HL == 255
13          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 134 HL match HL == 255
14          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 135 HL match HL == 255
15          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 136 HL match HL == 255
16          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 141 HL match HL == 255
17          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 142 HL match HL == 255
18          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 130
19          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 131
20          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 132
21          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 143
22          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 148 HL match HL == 255
23          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 149 HL match HL == 255
24          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 151 HL match HL == 1
25          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 152 HL match HL == 1
26          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 153 HL match HL == 1
27          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 128
28          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 129
29          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 144
30          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 145
31          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 146
32          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 147
33          0        0 ACCEPT     udp      *      *       fe80::/10
        fe80::/10            udp spt:547 dpt:546
34          0        0 ACCEPT     udp      *      *       ::/0
        ff02::fb             udp dpt:5353
35          0        0 ACCEPT     udp      *      *       ::/0
        ff02::f              udp dpt:1900
36          0        0 ufw6-user-input  all      *      *       ::/0
              ::/0

Chain ufw6-before-logging-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-before-logging-input (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-before-logging-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-before-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all      *      lo      ::/0
        ::/0
2           0        0 DROP       all      *      *       ::/0
        ::/0                 rt type:0
3           0        0 ACCEPT     all      *      *       ::/0
        ::/0                 ctstate RELATED,ESTABLISHED
4           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 1
5           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 2
6           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 3
7           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 4
8           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 133 HL match HL == 255
9           0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 136 HL match HL == 255
10          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 135 HL match HL == 255
11          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 134 HL match HL == 255
12          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 141 HL match HL == 255
13          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 142 HL match HL == 255
14          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 130
15          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 131
16          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 132
17          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 143
18          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 148 HL match HL == 255
19          0        0 ACCEPT     icmpv6    *      *       ::/0
         ::/0                 ipv6-icmptype 149 HL match HL == 255
20          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 151 HL match HL == 1
21          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 152 HL match HL == 1
22          0        0 ACCEPT     icmpv6    *      *       fe80::/10
         ::/0                 ipv6-icmptype 153 HL match HL == 1
23          0        0 ufw6-user-output  all      *      *       ::/0
               ::/0

Chain ufw6-logging-allow (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all      *      *       ::/0
        ::/0                 limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW ALLOW] "

Chain ufw6-logging-deny (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 RETURN     all      *      *       ::/0
        ::/0                 ctstate INVALID limit: avg 3/min burst 10
2           0        0 LOG        all      *      *       ::/0
        ::/0                 limit: avg 3/min burst 10 LOG flags 0
level 4 prefix "[UFW BLOCK] "

Chain ufw6-skip-to-policy-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 DROP       all      *      *       ::/0
        ::/0

Chain ufw6-skip-to-policy-input (6 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 DROP       all      *      *       ::/0
        ::/0

Chain ufw6-skip-to-policy-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all      *      *       ::/0
        ::/0

Chain ufw6-user-forward (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-user-input (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     tcp      *      *       ::/0
        ::/0                 tcp dpt:22
2           0        0 ACCEPT     udp      *      *       ::/0
        ::/0                 udp dpt:22
3           0        0 ACCEPT     tcp      *      *       ::/0
        ::/0                 tcp dpt:80
4           0        0 ACCEPT     udp      *      *       ::/0
        ::/0                 udp dpt:80
5           0        0 ACCEPT     tcp      *      *       ::/0
        ::/0                 tcp dpt:443
6           0        0 ACCEPT     udp      *      *       ::/0
        ::/0                 udp dpt:443
7           0        0 ACCEPT     tcp      *      *       ::/0
        ::/0                 tcp dpt:8883
8           0        0 ACCEPT     udp      *      *       ::/0
        ::/0                 udp dpt:8883

Chain ufw6-user-limit (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 LOG        all      *      *       ::/0
        ::/0                 limit: avg 3/min burst 5 LOG flags 0
level 4 prefix "[UFW LIMIT BLOCK] "
2           0        0 REJECT     all      *      *       ::/0
        ::/0                 reject-with icmp6-port-unreachable

Chain ufw6-user-limit-accept (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination
1           0        0 ACCEPT     all      *      *       ::/0
        ::/0

Chain ufw6-user-logging-forward (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-user-logging-input (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-user-logging-output (0 references)
num      pkts      bytes target     prot opt in     out     source
          destination

Chain ufw6-user-output (1 references)
num      pkts      bytes target     prot opt in     out     source
          destination

-----------------------------------


>
> Colin
>
> On Thu, 14 Mar 2019 at 09:49, <J.Witvliet at mindef.nl> wrote:
> >
> > Try:  iptables --line-numbers -nvxL
> > And ip6tables --line-numbers -nvxL
> >
> > People tend to forget the second one :-)
> >
> >
> > Met vriendelijke groet,
> > Hans Witvliet, J, Ing., DMO/OPS/I&S/APH, Kennis Team Opensource
> > Coldenhovelaan 1 Maasland 3531RC Coldehovelaan 1, kamer B213
> >
> > -----Original Message-----
> > From: ubuntu-users [mailto:ubuntu-users-bounces at lists.ubuntu.com] On Behalf Of Colin Law
> > Sent: donderdag 14 maart 2019 10:10
> > To: Ubuntu user technical support, not for general discussions
> > Subject: Re: Should ufw block access to localhost?
> >
> > On Thu, 14 Mar 2019 at 08:36, Tony Arnold <tony.arnold at manchester.ac.uk> wrote:
> > >
> > > Hi Colin,
> > >
> > > I guess a detailed examination of the IPtables that UFW has set up might yield some clues. But you've no doubt done that already!
> >
> > No, because my knowledge of IPtables is only skin deep.  I think the
> > principle reason for using ufw is to isolate one from the much more
> > complex details of IPtables.
> >
> > What I was hoping for was at least confirmation that what I am seeing
> > is, is not, expected, and if it is expected what I should do to allow
> > access from localhost.  Google has not provided any leads that have
> > helped me.  I found links explaining how to *block* access from
> > localhost but not the reverse, which suggests to me that access should
> > not be blocked by default.
> >
> > I can provide the IPtables list if anyone is willing, and has the
> > time, to look at it, for which I would be most grateful.  If so which
> > command should I use?  iptables -L?
> >
> > Colin
> >
> > Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.
> >
> > This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.
> > --
> > ubuntu-users mailing list
> > ubuntu-users at lists.ubuntu.com
> > Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users



More information about the ubuntu-users mailing list