Public bug reported: Binary package hint: ufw
AIUI, netfilter matching stops at the first ACCEPT rule. Ufw accepts "established" connections in the before-input ruies: # quickly process packets for which we already have a connection -A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT so this happens before any user rules. But I want to be able to do this: ufw deny default ufw allow in from 192.168.0.0/24 # allow ssh etc. from computers on the home network ufw deny proto tcp in to any 1:1023 and have it deny incoming connections to the priveleged ports _even if the connection tracker thinks they should be allowed_. I believe this could be achieved by moving the ESTABLISHED rule to after-input. I want to be able to override connection tracking because there's always going to be the possibility that it will get things wrong. In particular, there has been a recent claim that linux-based firewalls can be penetrated simply by visiting a malicious web page. I don't know whether this specific claim applies to Ubuntu, but I shouldn't have to worry about this class of attacks. <http://www.theregister.co.uk/2010/01/06/web_based_firewall_attack/> <http://samy.pl/natpin/> [I've not marked this bug as a security vulnerability, since fixing it won't improve the default security. Unless of course you decide to provide my rules as a default, but I don't suppose that's very likely]. ** Affects: ufw (Ubuntu) Importance: Undecided Status: New -- User deny rules should override connection tracking https://bugs.launchpad.net/bugs/507469 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
