UFW not working, even though it is enabled and the default rule is reject?

This is weird, because it definitely worked correctly before–I locked myself out of SSH at first.

Here’s the current setup, with ufw enabled:

~]$ sudo ufw status verbose
[sudo] password for NON_ADMIN_USER:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To Action From

10.0…x.y aa ALLOW IN Anywhere (log)
10.0.x.y bbb ALLOW IN Anywhere (log)
10.0.x.y cc ALLOW IN Anywhere (log)
10.0.x.y ddddd ALLOW IN Anywhere (log)
10.0.x.y eeeee ALLOW IN Anywhere

It is my understanding that with this setup, I should only be accepting connections on the 5 enumerated ports. Right?

Yet, from within my LAN I can connect to 10.0.x.y:fffff and connect.

ETA: Something doesn’t look right with systemctl on this one. What does active (exited) mean?

~]$ systemctl status ufw
● ufw.service - CLI Netfilter Manager
Loaded: loaded (/usr/lib/systemd/system/ufw.service; enabled; vendor preset: disabled)
Active: active (exited) since Sun 2020-12-20 21:51:51 CST; 4 weeks 1 days ago
Process: 189 ExecStart=/usr/lib/ufw/ufw-init start (code=exited, status=0/SUCCESS)
Main PID: 189 (code=exited, status=0/SUCCESS)

tl;dr What am I doing wrong this time?

Active/excited means that the UFW service is up and running. With the command:
sudo ufw status numbered

you can see what rules are applied.
This command:
sudo ufw allow from IP_ADDRESS_HERE to any port 22

opens port 22 for a specific ip address.
Fill in the ip address you want to connect from and the correct SSH port, 22 is the default. You’ll have to open the port in your router if you want to connect from outside your network or better yet use a VPN.
Make sure that the SSH service is enabled:

sudo systemctl enable --now sshd.service

I hope this was of any help.


My problem is more that everything is getting through, when the default reject all rule is active. e.g., I can connect to ports that the firewall should be blocking.

I think something got messed up in the configs, and I can’t figure out how to fix it even after enabling/disabling/starting/stopping ufw, so I’ve uninstalled it for now and will be reinstalling it and reactivating it tonight.