ufw breaks hotspot on bookworm

[mgrouch]

same ufw rules were working fine on bullseye

````

#!/bin/bash -e

# The rules are a bit loose for multicast

ufw default deny incoming
ufw default allow outgoing

ufw allow from 192.168.0.0/16
ufw allow from 169.254.0.0/16
ufw allow from 10.0.0.0/8

# carrier-grade NAT
ufw allow from 100.64.0.0/10

# For Garmin radar, etc
ufw allow from 172.16.0.0/12

# IPv6
ufw allow from fd00::/8
ufw allow from fe80::/10

# Multicast
ufw allow in proto udp from 224.0.0.0/4

# IPv6
ufw allow in proto udp from ff00::/8

# CanBus
ufw allow in on can0 to any

ufw enable

````

[Jamie Strandboge (jdstrand)]

Thanks for the bug, but this report lacks detail. Please provide the following:

1. what is the output of `sudo /usr/share/ufw/check-requirements -f`

2. are there any firewalls denials in /var/log/ufw.log or `sudo dmesg | grep UFW` at the time you tried to access the hotspot?

[Jamie Strandboge (jdstrand)]

Marking the Debian task as invalid for now; we'll focus on the upstream report.

[mgrouch (bbn-projects)]

I've managed to resolve it. Two changes fixed it for me.

Adding rules to DHCP traffic for ufw and adding WPA2 settings to the NetworkManager hotspot security

---
ufw default deny incoming
ufw default allow outgoing
ufw default allow routed

ufw allow from 127.0.0.1
ufw allow from 192.168.0.0/16
ufw allow from 169.254.0.0/16
ufw allow from 10.0.0.0/8

# carrier-grade NAT
ufw allow from 100.64.0.0/10

# For Garmin radar, etc
ufw allow from 172.16.0.0/12

# IPv6
ufw allow from fd00::/8
ufw allow from fe80::/10

# Multicast
ufw allow in proto udp from 224.0.0.0/4

# IPv6
ufw allow in proto udp from ff00::/8

# CanBus
ufw allow in on can0 to any

# DHCP bootstrap for AP
ufw allow in on wlan0 from any port 68 to any port 67 proto udp

# DNS for AP
ufw allow in on wlan0 from 10.0.0.0/8 to any port 53

ufw --force enable

---

---

[connection]
id=lysmarine-hotspot
uuid=cabf5cf8-e457-4480-bfdb-17e8e2c8a327
type=wifi
interface-name=wlan0
permissions=user:user:;

[wifi]
band=bg
mac-address-blacklist=
mode=ap
ssid=lysmarine-hotspot

[wifi-security]
key-mgmt=wpa-psk
pairwise=ccmp
psk=88888888

[ipv4]
dns-search=
method=shared

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
ip6-privacy=0
method=ignore

---

[mgrouch (bbn-projects)]

I think you can close it.
Thanks

[Jamie Strandboge (jdstrand)]

Thanks for getting back.