c/linux · by aprehendedmerlin@lemmy.dbzer0.com · 360d

UFW compatibility issues with my VPN

Hi all—as title suggests I'm experiencing a compatibility issue between UFW and my vpn (Windscribe if it matters). My UFW defaults are set to deny incoming, allow outgoing, and routed disabled, with no exception rules configured. When I enable Windscribe (I use OpenVPN udp on port 80 if that matters) while UFW is active, Windscribe reports a network configuration error and requests sending debug logs; ignoring the error still allows the VPN to function, but I observe IPv6 and DNS leaks. Disabling UFW removes the error and the leaks. What UFW configuration is causing this behavior, and which specific rules should I add to prevent IPv6 and DNS leaks while keeping UFW enabled?

19 points · 5 comments · view on lemmy.world

5 Comments

drspod@lemmy.ml · 5 pts · 360d (8 replies)

It might help if you paste a complete dump of your firewall rules. I'm not sure if ufw uses iptables of netfilter since I haven't used it before, but you can do:

for iptables firewalls:

iptables -L

for netfilter firewalls:

nft list ruleset

That might help debug exactly what ufw and your vpn are doing.

non_burglar@lemmy.world · 1 pts · 360d

Iptables (and nftables, among others) is just an implementation of netfilter kernel modules.

aprehendedmerlin@lemmy.dbzer0.com · 0 pts · 360d (6 replies)

[ removed ]

drspod@lemmy.ml · 3 pts · 359d (5 replies)

Thanks, looking at it now, but I should have remembered, iptables has a separate tool for ipv6 called ip6tables. Could you also paste the output of

ip6tables -L

If you put it in the comment between backticks like this:

```

```

then it will keep the formatting exactly as it was when you copied it, instead of munging the linebreaks.

aprehendedmerlin@lemmy.dbzer0.com · 1 pts · 359d

[ removed ]

aprehendedmerlin@lemmy.dbzer0.com · 1 pts · 359d (2 replies)

[ removed ]

drspod@lemmy.ml · 1 pts · 359d (1 reply)

Sorry to be a doofus, but could you paste the output of iptables-save and ip6tables-save instead? The default iptables output actually just leaves out important information like which interface the rule applies to.

I think the best thing to do would be to see if you can get support from Windscribe and find out whether it's a known issue or a bug that needs fixing.

aprehendedmerlin@lemmy.dbzer0.com · 1 pts · 358d

I did they said it just how their app is made and I should disable ufw

aprehendedmerlin@lemmy.dbzer0.com · 1 pts · 359d

[ removed ]