UFW inactive but IP forwarding blocked
I have two VMs (in VirtualBox), both of them are Ubuntu Server 18.10 (cosmic):
- the first one,
Server, has two NICs: one in NAT, the other one in intnet - the second machine,
Client, has only one NIC, in intnet, to communicate withServer
Now I would like to make Server a gateway, and so I've enabled IP forwarding (by modifying sysctl.conf, restarted it and so on.
When I check sudo ufw status (on Server), it says inactive. OK. But I cannot ping any external IP address on Client until I set iptables on Server with
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
As soon as I press Enter, ping command typed in Client does work. But why, since UFW is inactive??
networking server iptables firewall ufw
asked 10 hours ago
Greg82Greg82
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I have two VMs (in VirtualBox), both of them are Ubuntu Server 18.10 (cosmic):
- the first one,
Server, has two NICs: one in NAT, the other one in intnet - the second machine,
Client, has only one NIC, in intnet, to communicate withServer
Now I would like to make Server a gateway, and so I've enabled IP forwarding (by modifying sysctl.conf, restarted it and so on.
When I check sudo ufw status (on Server), it says inactive. OK. But I cannot ping any external IP address on Client until I set iptables on Server with
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
As soon as I press Enter, ping command typed in Client does work. But why, since UFW is inactive??
networking server iptables firewall ufw
asked 10 hours ago
Greg82Greg82
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I missed the part of your sysctl configuration there.
– Terrance
9 hours ago
UFW is only a front end to help things be easier. askubuntu.com/questions/952705/…
– Terrance
9 hours ago
add a comment |
I have two VMs (in VirtualBox), both of them are Ubuntu Server 18.10 (cosmic):
- the first one,
Server, has two NICs: one in NAT, the other one in intnet - the second machine,
Client, has only one NIC, in intnet, to communicate withServer
Now I would like to make Server a gateway, and so I've enabled IP forwarding (by modifying sysctl.conf, restarted it and so on.
When I check sudo ufw status (on Server), it says inactive. OK. But I cannot ping any external IP address on Client until I set iptables on Server with
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
As soon as I press Enter, ping command typed in Client does work. But why, since UFW is inactive??
networking server iptables firewall ufw
asked 10 hours ago
Greg82Greg82
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I have two VMs (in VirtualBox), both of them are Ubuntu Server 18.10 (cosmic):
- the first one,
Server, has two NICs: one in NAT, the other one in intnet - the second machine,
Client, has only one NIC, in intnet, to communicate withServer
Now I would like to make Server a gateway, and so I've enabled IP forwarding (by modifying sysctl.conf, restarted it and so on.
When I check sudo ufw status (on Server), it says inactive. OK. But I cannot ping any external IP address on Client until I set iptables on Server with
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
As soon as I press Enter, ping command typed in Client does work. But why, since UFW is inactive??
networking server iptables firewall ufw
networking server iptables firewall ufw
asked 10 hours ago
Greg82Greg82
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 10 hours ago
Greg82Greg82
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 10 hours ago
Greg82Greg82
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 10 hours ago
Greg82Greg82
1083
asked 10 hours ago
Greg82Greg82
1083
1083
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Greg82 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I missed the part of your sysctl configuration there.
– Terrance
9 hours ago
UFW is only a front end to help things be easier. askubuntu.com/questions/952705/…
– Terrance
9 hours ago
add a comment |
I missed the part of your sysctl configuration there.
– Terrance
9 hours ago
UFW is only a front end to help things be easier. askubuntu.com/questions/952705/…
– Terrance
9 hours ago
I missed the part of your sysctl configuration there.
– Terrance
9 hours ago
I missed the part of your sysctl configuration there.
– Terrance
9 hours ago
UFW is only a front end to help things be easier. askubuntu.com/questions/952705/…
– Terrance
9 hours ago
UFW is only a front end to help things be easier. askubuntu.com/questions/952705/…
– Terrance
9 hours ago
add a comment |
1 Answer
1
active
oldest
votes
UFW being inactive has nothing to do with it.
In iptables parlance, you must have a MASQUERADE rule set in the NAT table for traffic to work being forwarded outbound regardless. Otherwise, the system won't know what to do with the packets. This remains the case even if you directly use iptables to manipulate the *filter rules (to set INPUT, OUTPUT, etc. access control lists and such, or even to just ALLOW all traffic on those policysets) - NAT always is in play and you have to add the NAT rule to make forwarded traffic masquerade out to the Internet as the server's primary IP.
Therefore, you must add the rule whether using UFW or not in order to get the system to understand how to translate the packet and route it via the server to the Internet, and thus how to automatically handle the reverse routing as well.
This Github GIST which I found has a pretty good explanation of what to do for this for UFW:
The final step is to add NAT to ufw’s configuration. Add the following
to /etc/ufw/before.rules just before the filter rules.
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
@Greg82 it's not a case of disablingiptables- you still need theMASQUERADErule either way. ANd yes, UFW is a frontend for easy management ofiptablesrules, but that only is insomuchas to make it easy to manage access rules,MASQUERADErules, etc. need to be edited into theufwconfiguration file for rules to do before it applies access rules.
– Thomas Ward♦
7 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Greg82 is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1120182%2fufw-inactive-but-ip-forwarding-blocked%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
UFW being inactive has nothing to do with it.
In iptables parlance, you must have a MASQUERADE rule set in the NAT table for traffic to work being forwarded outbound regardless. Otherwise, the system won't know what to do with the packets. This remains the case even if you directly use iptables to manipulate the *filter rules (to set INPUT, OUTPUT, etc. access control lists and such, or even to just ALLOW all traffic on those policysets) - NAT always is in play and you have to add the NAT rule to make forwarded traffic masquerade out to the Internet as the server's primary IP.
Therefore, you must add the rule whether using UFW or not in order to get the system to understand how to translate the packet and route it via the server to the Internet, and thus how to automatically handle the reverse routing as well.
This Github GIST which I found has a pretty good explanation of what to do for this for UFW:
The final step is to add NAT to ufw’s configuration. Add the following
to /etc/ufw/before.rules just before the filter rules.
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
@Greg82 it's not a case of disablingiptables- you still need theMASQUERADErule either way. ANd yes, UFW is a frontend for easy management ofiptablesrules, but that only is insomuchas to make it easy to manage access rules,MASQUERADErules, etc. need to be edited into theufwconfiguration file for rules to do before it applies access rules.
– Thomas Ward♦
7 hours ago
add a comment |
UFW being inactive has nothing to do with it.
In iptables parlance, you must have a MASQUERADE rule set in the NAT table for traffic to work being forwarded outbound regardless. Otherwise, the system won't know what to do with the packets. This remains the case even if you directly use iptables to manipulate the *filter rules (to set INPUT, OUTPUT, etc. access control lists and such, or even to just ALLOW all traffic on those policysets) - NAT always is in play and you have to add the NAT rule to make forwarded traffic masquerade out to the Internet as the server's primary IP.
Therefore, you must add the rule whether using UFW or not in order to get the system to understand how to translate the packet and route it via the server to the Internet, and thus how to automatically handle the reverse routing as well.
This Github GIST which I found has a pretty good explanation of what to do for this for UFW:
The final step is to add NAT to ufw’s configuration. Add the following
to /etc/ufw/before.rules just before the filter rules.
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
@Greg82 it's not a case of disablingiptables- you still need theMASQUERADErule either way. ANd yes, UFW is a frontend for easy management ofiptablesrules, but that only is insomuchas to make it easy to manage access rules,MASQUERADErules, etc. need to be edited into theufwconfiguration file for rules to do before it applies access rules.
– Thomas Ward♦
7 hours ago
add a comment |
UFW being inactive has nothing to do with it.
In iptables parlance, you must have a MASQUERADE rule set in the NAT table for traffic to work being forwarded outbound regardless. Otherwise, the system won't know what to do with the packets. This remains the case even if you directly use iptables to manipulate the *filter rules (to set INPUT, OUTPUT, etc. access control lists and such, or even to just ALLOW all traffic on those policysets) - NAT always is in play and you have to add the NAT rule to make forwarded traffic masquerade out to the Internet as the server's primary IP.
Therefore, you must add the rule whether using UFW or not in order to get the system to understand how to translate the packet and route it via the server to the Internet, and thus how to automatically handle the reverse routing as well.
This Github GIST which I found has a pretty good explanation of what to do for this for UFW:
The final step is to add NAT to ufw’s configuration. Add the following
to /etc/ufw/before.rules just before the filter rules.
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
UFW being inactive has nothing to do with it.
In iptables parlance, you must have a MASQUERADE rule set in the NAT table for traffic to work being forwarded outbound regardless. Otherwise, the system won't know what to do with the packets. This remains the case even if you directly use iptables to manipulate the *filter rules (to set INPUT, OUTPUT, etc. access control lists and such, or even to just ALLOW all traffic on those policysets) - NAT always is in play and you have to add the NAT rule to make forwarded traffic masquerade out to the Internet as the server's primary IP.
Therefore, you must add the rule whether using UFW or not in order to get the system to understand how to translate the packet and route it via the server to the Internet, and thus how to automatically handle the reverse routing as well.
This Github GIST which I found has a pretty good explanation of what to do for this for UFW:
The final step is to add NAT to ufw’s configuration. Add the following
to /etc/ufw/before.rules just before the filter rules.
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
edited 7 hours ago
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
answered 9 hours ago
Thomas Ward♦Thomas Ward
44.5k23124177
44.5k23124177
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
@Greg82 it's not a case of disablingiptables- you still need theMASQUERADErule either way. ANd yes, UFW is a frontend for easy management ofiptablesrules, but that only is insomuchas to make it easy to manage access rules,MASQUERADErules, etc. need to be edited into theufwconfiguration file for rules to do before it applies access rules.
– Thomas Ward♦
7 hours ago
add a comment |
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
@Greg82 it's not a case of disablingiptables- you still need theMASQUERADErule either way. ANd yes, UFW is a frontend for easy management ofiptablesrules, but that only is insomuchas to make it easy to manage access rules,MASQUERADErules, etc. need to be edited into theufwconfiguration file for rules to do before it applies access rules.
– Thomas Ward♦
7 hours ago
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
Thanks Thomas. I thought that ufw was more on less a "frontend" for iptables? If not, is there a mean to "disable" iptables?
– Greg82
9 hours ago
@Greg82 it's not a case of disabling
iptables - you still need the MASQUERADE rule either way. ANd yes, UFW is a frontend for easy management of iptables rules, but that only is insomuchas to make it easy to manage access rules, MASQUERADE rules, etc. need to be edited into the ufw configuration file for rules to do before it applies access rules.– Thomas Ward♦
7 hours ago
@Greg82 it's not a case of disabling
iptables - you still need the MASQUERADE rule either way. ANd yes, UFW is a frontend for easy management of iptables rules, but that only is insomuchas to make it easy to manage access rules, MASQUERADE rules, etc. need to be edited into the ufw configuration file for rules to do before it applies access rules.– Thomas Ward♦
7 hours ago
add a comment |
Greg82 is a new contributor. Be nice, and check out our Code of Conduct.
Greg82 is a new contributor. Be nice, and check out our Code of Conduct.
Greg82 is a new contributor. Be nice, and check out our Code of Conduct.
Greg82 is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1120182%2fufw-inactive-but-ip-forwarding-blocked%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I missed the part of your sysctl configuration there.
– Terrance
9 hours ago
UFW is only a front end to help things be easier. askubuntu.com/questions/952705/…
– Terrance
9 hours ago