18
UFW compatibility issues with my VPN (lemmy.dbzer0.com)
submitted 1 year ago by to c/linux@lemmy.ml
6 comments fedilink hide all child comments
 

Hi all—as title suggests I'm experiencing a compatibility issue between UFW and my vpn (Windscribe if it matters). My UFW defaults are set to deny incoming, allow outgoing, and routed disabled, with no exception rules configured. When I enable Windscribe (I use OpenVPN udp on port 80 if that matters) while UFW is active, Windscribe reports a network configuration error and requests sending debug logs; ignoring the error still allows the VPN to function, but I observe IPv6 and DNS leaks. Disabling UFW removes the error and the leaks. What UFW configuration is causing this behavior, and which specific rules should I add to prevent IPv6 and DNS leaks while keeping UFW enabled?

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 year ago (4 children)

It might help if you paste a complete dump of your firewall rules. I'm not sure if ufw uses iptables of netfilter since I haven't used it before, but you can do:

for iptables firewalls:

iptables -L

for netfilter firewalls:

nft list ruleset

That might help debug exactly what ufw and your vpn are doing.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [+] [S] 0 points 1 year ago (3 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 1 year ago (2 children)

    Thanks, looking at it now, but I should have remembered, iptables has a separate tool for ipv6 called ip6tables. Could you also paste the output of

    ip6tables -L

    If you put it in the comment between backticks like this:

    ```

    ```

    then it will keep the formatting exactly as it was when you copied it, instead of munging the linebreaks.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] [S] 1 point 1 year ago (2 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago (1 child)

    Sorry to be a doofus, but could you paste the output of iptables-save and ip6tables-save instead? The default iptables output actually just leaves out important information like which interface the rule applies to.

    I think the best thing to do would be to see if you can get support from Windscribe and find out whether it's a known issue or a bug that needs fixing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (-1 replies)
    • load more comments (-1 replies)