I recently added some rules to GUFW to make sure only my (personal) VPN connection is allowed to get out, x.x.x.x being my ip, y.y.y.y being my VPN's IP I connect to.
To - Action - From
y.y.y.y ALLOW OUT x.x.x.x
Anywhere DENY OUT x.x.x.x
So far, everything worked fine : nothing could pass through, except my VPN connection, which would then have everything tunnel through it. Internet, everything work.
I want to scan a host (t.t.t.t) on my home network to identify it. So I try to do a Syn scan using nmap :
sudo nmap t.t.t.t -sS -v
However it seem that the firewall is blocking the probes as I'm getting this :
sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, t.t.t.t, 16) => Operation not permitted
So I added this rule :
x.x.0.0/16 ALLOW OUT x.x.x.x
Strangely I still get the same error, even if I use a /24 netmask. Deactivating the firewall does the trick, but I'm looking for a real solution there.
Any clue on what might be the problem ? Thanks.
SOLVED : The order of the rules of iptables is very important. Since gufw is a simplification of it, I had to change the order of the rules. FIRST, you ALLOW the interface to communicate to the subnet, THEN you DENY the interface the communication to the rest of the world. I can ping, scan, etc the subnet now, and the rest of the internet is blocked if I'm not using the VPN : pings, scan... can't go outside.