Nmap scan on my LAN is blocked by my host firewall (Linux)

Question

I recently added some rules to GUFW to make sure only my (personal) VPN connection is allowed to get out, x.x.x.x being my ip, y.y.y.y being my VPN's IP I connect to.

To - Action - From

y.y.y.y ALLOW OUT x.x.x.x

Anywhere DENY OUT x.x.x.x

So far, everything worked fine : nothing could pass through, except my VPN connection, which would then have everything tunnel through it. Internet, everything work.

I want to scan a host (t.t.t.t) on my home network to identify it. So I try to do a Syn scan using nmap :

sudo nmap t.t.t.t -sS -v

However it seem that the firewall is blocking the probes as I'm getting this :

sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, t.t.t.t, 16) => Operation not permitted

So I added this rule :

x.x.0.0/16 ALLOW OUT x.x.x.x

Strangely I still get the same error, even if I use a /24 netmask. Deactivating the firewall does the trick, but I'm looking for a real solution there.

Any clue on what might be the problem ? Thanks.

SOLVED : The order of the rules of iptables is very important. Since gufw is a simplification of it, I had to change the order of the rules. FIRST, you ALLOW the interface to communicate to the subnet, THEN you DENY the interface the communication to the rest of the world. I can ping, scan, etc the subnet now, and the rest of the internet is blocked if I'm not using the VPN : pings, scan... can't go outside.

Answer 1

As I said in my edit, the order of the rules is very important.

Even for gufw, you need to take that into account. So, to do what I intended to do :

You first ALLOW the interface to communicate with the subnet (x.x.0.0/16), then you DENY communication with the rest of the world.

I had reversed the order, unsure of what rule would be taken first into account.