I recently added some rules to GUFW to make sure only my (personal) VPN connection is allowed to get out, x.x.x.x being my ip, y.y.y.y being my VPN's IP I connect to.

To - Action - From

y.y.y.y ALLOW OUT x.x.x.x

Anywhere DENY OUT x.x.x.x

So far, everything worked fine : nothing could pass through, except my VPN connection, which would then have everything tunnel through it. Internet, everything work.

I want to scan a host (t.t.t.t) on my home network to identify it. So I try to do a Syn scan using nmap :

sudo nmap t.t.t.t -sS -v

However it seem that the firewall is blocking the probes as I'm getting this :

sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, t.t.t.t, 16) => Operation not permitted

So I added this rule :

x.x.0.0/16 ALLOW OUT x.x.x.x

Strangely I still get the same error, even if I use a /24 netmask. Deactivating the firewall does the trick, but I'm looking for a real solution there.

Any clue on what might be the problem ? Thanks.

SOLVED : The order of the rules of iptables is very important. Since gufw is a simplification of it, I had to change the order of the rules. FIRST, you ALLOW the interface to communicate to the subnet, THEN you DENY the interface the communication to the rest of the world. I can ping, scan, etc the subnet now, and the rest of the internet is blocked if I'm not using the VPN : pings, scan... can't go outside.

  • Restarting didn't change anything, however I've found the solution. – user96649 Jun 21 '16 at 7:07

As I said in my edit, the order of the rules is very important.

Even for gufw, you need to take that into account. So, to do what I intended to do :

You first ALLOW the interface to communicate with the subnet (x.x.0.0/16), then you DENY communication with the rest of the world.

I had reversed the order, unsure of what rule would be taken first into account.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.