How can ufw do me like that?
from skaarl@feddit.nl to linux@lemmy.ml on 27 Jul 15:37
https://feddit.nl/post/39121551

Something strange happened just now, im trying to figure out how exactly did it happen. On my server I was suddely able to bypass my VPN! I looked around what did happened and found that my VPN service had sent me an email that my subscription expired. What is strange is that I have ufw rules like

To                         Action      From

[VPN server]               ALLOW OUT   Anywhere                  
Anywhere                   ALLOW OUT   Anywhere on tun0

So it should be not allowed to access the internet outside of tun0. Why exactly did it happen? Does the VPN service change iptables or something? Any ideas? I was able to ping, wget, even surf on w3m. The thing is that when I rebooted the server, nothing could connect outside the tunnel, as it should be. Here is the whole ufw table.

Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    192.168.1.0/24            
53                         ALLOW IN    192.168.1.0/24            
80                         ALLOW IN    192.168.1.0/24            
9091                       ALLOW IN    192.168.1.0/24              # Transmission
2049                       ALLOW IN    192.168.1.0/24              # nfs

[VPN server]               ALLOW OUT   Anywhere                  
Anywhere                   ALLOW OUT   Anywhere on tun0          
192.168.2.77 22            ALLOW OUT   Anywhere                  
2049                       ALLOW OUT   Anywhere                   # nfs

So how in the world did my VPN company do something to bypass my ufw??? Or was it something else completely?

TIA

#linux

threaded - newest

taaz@biglemmowski.win on 27 Jul 16:21 next collapse

Best bet would be that something reloaded/changed the underlying ip/nftables bypassing ufw (ufw is just a frontend, I do not know if it periodically verifies the current rules are correct and it would feel extraneous to me if it did). Or it didn’t apply it correctly.

You can get the actual rules with iptables-save (dunno about nftables command)

2xsaiko@discuss.tchncs.de on 27 Jul 17:15 collapse

That would be ‘nft list ruleset’

shiiiiiiiiiiiiiiiiiiiiiiiiiiiiiit@sh.itjust.works on 27 Jul 19:14 next collapse

Are you running docker?

UFW is a popular iptables front end on Ubuntu that makes it easy to manage firewall rules. But when Docker is installed, Docker bypass the UFW rules and the published ports can be accessed from outside.

github.com/chaifeng/ufw-docker

blobjim@hexbear.net on 27 Jul 19:18 next collapse

How do you know your VPN was “bypassed”? What was the symptom?

fmstrat@lemmy.nowsci.com on 27 Jul 21:05 next collapse

Did you run a traceroute before rebooting?

Sounds like your VPN software does some wacky stuff with IPtables. Personally, I’d switch to the native Wireguard client, and use iptables to block outbound.

taters@piefed.social on 27 Jul 23:10 collapse

I've had experiences with certain software manipulating iptables behind ufw and those changes do not show up when I viewed ufw's status.

Docker is a well known example of this. Simply searching docker ufw in a search engine will bring up this issue immediately. I've also had experiences with cloudflared (the program used for cloudflare's tunnel service) manipulating iptables behind ufw as well.

It's possible the vpn is doing something similar.

I'm beginning to learn to check iptables as well when it comes to troubleshooting network issues.