gerbrands.blogg.se

# drop INVALID packets (logs these in loglevel medium and higher) A ufw-before-forward -m conntrack -ctstate RELATED,ESTABLISHED -j ACCEPT A ufw-before-output -m conntrack -ctstate RELATED,ESTABLISHED -j ACCEPT A ufw-before-input -m conntrack -ctstate RELATED,ESTABLISHED -j ACCEPT # quickly process packets for which we already have a connection # Don't delete these required lines, otherwise there will be errors # rules should be added to one of these chains: # Rules that should be run before the ufw command line added rules. My only change was the NAT table rules: # Is there a way I get can get the UFW rules to somehow apply after the NAT does its thing? So my question is simple - I want the private PC to get connectivity through Ubuntu such as the NAT provided, but with the outgoing restrictions as I thought I configured initially using the ufw command lines. Now all traffic is getting out and returned to my private PC, the default deny outgoing and the other UFW rules all seem to be bypassed. # don't delete the 'COMMIT' line or these nat table rules won't # Forward traffic through eth0 - Change to match you out-interface So after a bit more reading, I found I needed to set up NAT and masquerading, so I put the following into rules.before: # NAT table rules

Using Wireshark I can see DNS requests being made on both enp0s3 and enp0s8, but the ones on enp0s3 have no reply. I followed some instructions to add some "route allow" rules such as it results in: ufw status verboseĭefault: deny (incoming), deny (outgoing), allow (routed)Ĩ.8.8.8 on enp0s3 ALLOW FWD Anywhere on enp0s8Ĩ.8.4.4 on enp0s3 ALLOW FWD Anywhere on enp0s8ġ0.0.1.5 on enp0s8 ALLOW FWD Anywhere on enp0s3ġ0.0.1.5 is my private PC. To start with, I wanted to see if I could just allow DNS from the private box through the Ubuntu. The Ubuntu box has two NICs, one is internet facing (enp0s3), one is facing this single private PC (enp0s8). I am trying to use Ubuntu as a router of a kind by limiting a computer on my private network to what it can connect to on the internet.