Connectivity lost when enabling the Cloud Firewall
Hi all, I need help setting up the Cloud Firewall.
I added the following set of rules through Linode Manager.
Inbound rules
Label Protocol Port Range Sources Action
accept-inbound-SSH TCP 22 All IPv4, All IPv6 Accept
accept-inbound-HTTP TCP 80 All IPv4, All IPv6 Accept
accept-inbound-HTTPS TCP 443 All IPv4, All IPv6 Accept
accept-inbound-DNS TCP 53 All IPv4, All IPv6 Accept
Default inbound policy: Drop
Outbound Rules
Label Protocol Port Range Destinations Action
accept-outbound-SSH TCP 22 All IPv4, All IPv6 Accept
accept-outbound-HTTP TCP 80 All IPv4, All IPv6 Accept
accept-outbound-HTTPS TCP 443 All IPv4, All IPv6 Accept
accept-outbound-HTTPS DNS 443 All IPv4, All IPv6 Accept
accept-outbound-DNS TCP 53 All IPv4, All IPv6 Accept
Default inbound policy: Drop
When I enable them, I lose all connectivity from inside the VPS. Can't apt update
, can't ping 8.8.8.8
. Any clues?
Edit: fixed copy-paste
6 Replies
✓ Best Answer
No worries, just didn't want an open resolver out there haha.
Change the outbound for DNS to UDP.
@Tntdruid Thanks for your answer. Yes, I did enable port 53 (inbound & outbound) for DNS. I messed the my copy-paste of my rules and have corrected my first post. Sorry about that.
Your firewall rules don't allow outbound pings so those will fail to even send.
Are you sure you want to allow inbound DNS?
I am not sure how you added DNS 443. I am not able to do this in the GUI so maybe something only in CLI.
@nixhex Thanks for your input. You're right, allowing inbound DNS makes no sense. I guess I was desperate and ready to allow anything! (Which kind of defeats the purpose.) Removed it.
Boy did I mess up the copy-paste of those rules. Here goes again, hoping to get it right this time.
Still no luck. :(
Inbound rules
Label Protocol Port Range Sources Action
accept-inbound-SSH TCP 22 All IPv4, All IPv6 Accept
accept-inbound-HTTP TCP 80 All IPv4, All IPv6 Accept
accept-inbound-HTTPS TCP 443 All IPv4, All IPv6 Accept
Default inbound policy: Drop
Outbound Rules
Label Protocol Port Range Destinations Action
accept-outbound-SSH TCP 22 All IPv4, All IPv6 Accept
accept-outbound-HTTP TCP 80 All IPv4, All IPv6 Accept
accept-outbound-HTTPS TCP 443 All IPv4, All IPv6 Accept
accept-outbound-DNS TCP 53 All IPv4, All IPv6 Accept
Default inbound policy: Drop