| Skyrider | Can I ask a ufw related question here? | 09:42 |
|---|---|---|
| Skyrider | Might as well.. Used ufw to block an ip range x.x.0.0/16, yet it doesn't appear to work. All the other ufw rules are working, just not this ranged deny I created. | 09:48 |
| tomreyn | Skyrider: i would not recommend ufw for a server firewall. rather use iptables directly or some framework around it such as shorewall. | 12:58 |
| JanC | well, ufw is a framework around it | 12:58 |
| tomreyn | yes, but... not a complete or really good one | 12:59 |
| JanC | it should be able to do what most people need for a simple server, no? | 13:02 |
| tomreyn | yes, as long as they don't use the GUI for managing it. | 13:03 |
| tomreyn | thats my personal POV, anyways | 13:04 |
| JanC | ufw itself doesn't have a GUI | 13:04 |
| tomreyn | gufw is a separate package, but i think it's preinstalled. | 13:05 |
| tomreyn | ...on desktops | 13:05 |
| JanC | I doubt it is | 13:05 |
| JanC | it never supported ufw correctly, and hasn't been updated in a decade probably? | 13:06 |
| tomreyn | hmm its in universe, probably not then, right | 13:06 |
| Skyrider | Using ufw as I prefer its simplicity. | 13:07 |
| tomreyn | so let's say ufw can be fine, just dont use gufw | 13:07 |
| JanC | Skyrider: I assume you didn't forget to reload the firewall after adding that rule? | 13:07 |
| JanC | also "doesn't appear to work" is rather vague | 13:09 |
| Skyrider | all rules added through ufw should be instantly loaded. | 13:13 |
| Skyrider | As for gufw, don't see a point in that seeing I use a headless server. | 13:13 |
| Skyrider | And "doesn't work", I blocked an ip range and had to block the IP range in nginx as well. The blocked IP's keeps showing up in nginx's logs, while it shouldn't be logged at all as ufw should deal with it. | 13:14 |
| Skyrider | Maybne ufw ip range deny/reject is borked? | 13:14 |
| JanC | there is no other rule overriding it? | 13:15 |
| Skyrider | Guess that's a fair point I haven't considered. allow port 80 I suppose. | 13:16 |
| Skyrider | But shouldn't deny/reject override allow? | 13:16 |
| Skyrider | It is listed in iptables: -A ufw-user-input -s 159.138.0.0/16 -j REJECT --reject-with icmp-port-unreachabl e | 13:17 |
| Skyrider | As for ufw, was last updated 2018-12-14 | 13:19 |
| JanC | rule ordering? | 13:22 |
| JanC | you'd need to have the deny for that range before the one to allow port 80 | 13:23 |
| JanC | as the first one that matches will be applied | 13:25 |
| JanC | Skyrider: ^^^ | 13:30 |
| Skyrider | Thanks JanC, but I double checked. All rejects in ufw are set to top. | 13:40 |
| Skyrider | [10] Anywhere REJECT IN 159.138.0.0/16 | 13:40 |
| Skyrider | [11] 80/tcp ALLOW IN Anywhere | 13:40 |
| Skyrider | 1 to 9 are also rejects. | 13:40 |
| === vlm_ is now known as vlm | ||
| === tops is now known as jobs | ||
| === jobs is now known as tjobsl | ||
| === tjobsl is now known as tops | ||
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!