Thank you for filing a bug. The firewall policy is a combination of the default policy for each of 'incoming', 'outgoing' and 'routed' (forward) along with the policies shipped in before{,6}.rules, after{,6}.rules and whatever gets added to user{,6}.rules. Specifically, what is in before{,6}.rules is designed with default deny for incoming (and forward), default allow for outgoing and default accept for established connections. Considering that dhcp uses port 68/udp for the client and port 67/udp for the server, the shipped default policy allows:
* outgoing from this host port 68/udp to any port 67/udp (via default allow outgoing; eg, for dhcp request) * incoming for established connection (via before.rules RELATED,ESTABLISHED; eg, dhcp reply from the server we connected to on port 67/udp) * incoming from port 67/udp (via the before.rules you mentioned; eg, for a server responding to the broadcast) I suspect that you've updated your default policy to deny to perform egress filtering so you need to add a corresponding 'ufw allow out to any port 67 proto udp comment "dhcp discover"' rule or similar. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ufw in Ubuntu. https://bugs.launchpad.net/bugs/1882484 Title: Firewall rule in before.rules for dhcp is wrong Status in ufw package in Ubuntu: Invalid Bug description: The file delivered - /usr/share/ufw/iptables/before.rules which is then copied to - /etc/ufw/before.rules Delivered by Package: # allow dhcp client to work -A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT The ports for --sport and --dport are swapped Should be: -A ufw-before-input -p udp --sport 68 --dport 67 -j ACCEPT Package version found in: 0.36-0ubuntu0.1 Note: ISC DHCP uses RAW sockets, which bypasses iptables anyway and doesn't drop the packets with the incorrect configuration. This has had me stumped for the last hour. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ufw/+bug/1882484/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp