Allowing all UDP/TCP traffic in

[jean-christophe manciot]

Environment: Ubuntu 14.10 - Gufw 14.10.1
------------------

The configuration is basic:
- Incoming: Deny
- Outgoing: Allow
- Routing: Allow

Now, suppose you need to allow internal communication, for example all incoming UDP/TCP traffic from a VirtualBox VM on vboxnet0 sitting on a particular subnet, 192.168.56.0/24 is used here.

Using Gufw to implement this simple setup does NOT work (UDP communication is still blocked - TCP configuration is not shown): https://drive.google.com/file/d/0B5fXyIn0-GDFbUpMaW0zVTlqYUE/view?usp=sharing

However, using ufw allows us to attain our goal:
ufw status
Status: active

To Action From
-- ------ ----
192.168.56.1 1:65535/tcp ALLOW 192.168.56.0/24
192.168.56.1 1:65535/udp ALLOW 192.168.56.0/24

This simple configuration allows all UDP/TCP communication in from 192.168.56.0/24 towards the host servers.

The problem is: it is not possible to use Gufw to make that setup, and once it is done through ufw CLI, it is not possible to display or edit it within Gufw.

As a summary:
--------------------
- allowing all TCP/UDP communication IN is not possible with Gufw (have I missed something?)
- displaying/editing some ufw rules is not possible within gufw (have I missed something?)

[costales (costales)]

Hi Jean! How are you? :)

In the Log tab I see this message: "ERROR: Bad source address".
Reviewing your screenshot, your "From IP" is this "192.168.168.56.0/24", it's a wrong IP, you set 2 times the "168" :) With this IP "192.168.56.0/24" is working for me.

> allowing all TCP/UDP communication IN is not possible with Gufw

Yes, it has to work, just add a rule with "Protocol = Both" and "Direction = IN". Do you have a screenshot when you can't add it? :)

> displaying/editing some ufw rules is not possible within gufw

Yes, it's right. When you add a rule in Gufw, I'm store how that rule is for the comment, edit... I want to say, a rule from ufw is complicate to rebuild its command. Then, you can't edit ufw rules, I'm sorry.

Best regards Jean!

[jean-christophe manciot (manciot-jeanchristophe)]

I'm fine, thanks, how are you?

You're right, but it does not change anything if I set the right subnet; the problem actually comes from the fact that I've specified vboxnet0 after the ">" sign, instead of specifying "not forward": my mistake.

However, you cannot add a unique rule for both protocols: only one is allowed ***when the ports are set***: https://drive.google.com/file/d/0B5fXyIn0-GDFSEVQOG5meDVOTE0/view?usp=sharing

If I remove the ports number, then it's OK to add the rule: https://drive.google.com/file/d/0B5fXyIn0-GDFZ3JFNWpwbEVuTlE/view?usp=sharing

With that rule added within gufw, the firewall accepts the communications in vboxnet0.
-------------------------------------------------------------------------------------------
The trick was to specify "Not forward" after the ">" sign. No need for ufw rule anymore :)
-------------------------------------------------------------------------------------------

[costales (costales)]

I'm fine :) Thanks!

If I reproduce your first screenshot I'm getting this error: ERROR: Must specify 'tcp' or 'udp' with multiple ports
That is not a problem of interfaces, it's a problem that in ufw if you're using a port range, you have to add tcp and udp in split rules (both rule = tcp + udp rules).
I created a really simple rule with a port range, please see my attachment. That is returning an error too from ufw ;)

I'm not sure if I replied to all your questions :$ Please, ping me if not :) Be my guest!
Best regards Jean!

[jean-christophe manciot (manciot-jeanchristophe)]

The comment about the ">" interface is not tied to the "port range" gliitch.

I confirm that this issue/limitation comes from ufw, not from gufw; sorry about that.

[costales (costales)]

Ah! OK! :) About the ">" interface,

The ">" is a forward of the traffic, then you're telling ufw: forward "from vboxnet0 > to > vboxnet0". I think in ufw you can't forward one interface over the same. It'll add a warning in "Add" Gufw window about this.

If you just want to set a rule for the vboxnet0 and not apply that rules to other interfaces, it'd be as you said: "from vboxnet0 > to > not forward".

Are all of your issues answered? :)
Best regards!

[costales (costales)]

Fixed #1402220 Not allow one interface over the same interface

[costales (costales)]

Fixed #1402232 Specify TCP or UDP Protocol with multiple ports