Score:0

Ubuntu

How to configure UFW rules to whitelist IPs on Ubuntu web server?

mhweb

10/23/23, 10:32 PM

On an Ubuntu web server, I am configuring UFW to whitelist the Cloudflare IPs, but for some reason, the 162.158.0.0/15 range continues to be blocked.

Do I need to change the order of the rules even though I don't have any "deny" rules?

This is how the ufw is configured:

22/tcp                     LIMIT IN    Anywhere
80,443/tcp (Apache Full)   ALLOW IN    Anywhere
80/tcp                     ALLOW IN    103.21.244.0/22
80/tcp                     ALLOW IN    103.22.200.0/22
80/tcp                     ALLOW IN    103.31.4.0/22
80/tcp                     ALLOW IN    104.16.0.0/13
80/tcp                     ALLOW IN    104.24.0.0/14
80/tcp                     ALLOW IN    108.162.192.0/18
80/tcp                     ALLOW IN    131.0.72.0/22
80/tcp                     ALLOW IN    141.101.64.0/18
80/tcp                     ALLOW IN    162.158.0.0/15
80/tcp                     ALLOW IN    172.64.0.0/13
80/tcp                     ALLOW IN    173.245.48.0/20
80/tcp                     ALLOW IN    188.114.96.0/20
80/tcp                     ALLOW IN    190.93.240.0/20
80/tcp                     ALLOW IN    197.234.240.0/22
80/tcp                     ALLOW IN    198.41.128.0/17
443/tcp                    ALLOW IN    103.21.244.0/22
443/tcp                    ALLOW IN    103.22.200.0/22
443/tcp                    ALLOW IN    103.31.4.0/22
443/tcp                    ALLOW IN    104.16.0.0/13
443/tcp                    ALLOW IN    104.24.0.0/14
443/tcp                    ALLOW IN    108.162.192.0/18
443/tcp                    ALLOW IN    131.0.72.0/22
443/tcp                    ALLOW IN    141.101.64.0/18
443/tcp                    ALLOW IN    162.158.0.0/15
443/tcp                    ALLOW IN    172.64.0.0/13
443/tcp                    ALLOW IN    173.245.48.0/20
443/tcp                    ALLOW IN    188.114.96.0/20
443/tcp                    ALLOW IN    190.93.240.0/20
443/tcp                    ALLOW IN    197.234.240.0/22
443/tcp                    ALLOW IN    198.41.128.0/17
22/tcp (v6)                LIMIT IN    Anywhere (v6)
80,443/tcp (Apache Full (v6)) ALLOW IN    Anywhere (v6)
80/tcp                     ALLOW IN    2400:cb00::/32
80/tcp                     ALLOW IN    2405:8100::/32
80/tcp                     ALLOW IN    2405:b500::/32
80/tcp                     ALLOW IN    2606:4700::/32
80/tcp                     ALLOW IN    2803:f800::/32
80/tcp                     ALLOW IN    2a06:98c0::/29
80/tcp                     ALLOW IN    2c0f:f248::/32
443/tcp                    ALLOW IN    2400:cb00::/32
443/tcp                    ALLOW IN    2405:8100::/32
443/tcp                    ALLOW IN    2405:b500::/32
443/tcp                    ALLOW IN    2606:4700::/32
443/tcp                    ALLOW IN    2803:f800::/32
443/tcp                    ALLOW IN    2a06:98c0::/29
443/tcp                    ALLOW IN    2c0f:f248::/32

This is an example of the block I see in the ufw logs:

Oct 23 18:16:49 server kernel: [14492.469894] [UFW BLOCK] IN=eth0 OUT= MAC=aa:54:00:00 SRC=162.158.62.224 DST=192.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP SPT=46078 DPT=443 WINDOW=0 RES=0x00 RST URGP=0

PS: Edited the source IP and Mac.

0 + 10

server

ufw

Doug Smythies

10/23/23, 11:52 PM

Based on the TCP flags, there is no problem. See [here](https://askubuntu.com/questions/1187993/ufw-occasionally-blocking-https-443-tcp-although-configured-to-allow-that-port/1188016#1188016).

mhweb

10/25/23, 12:54 AM

OK, but why am I getting locked out of the site 24hrs after enabling the CDN? because it thinks the IP 162.158.62.224 is me when this is a Cloudflare IP and shortly after the website start getting the error 521.

Doug Smythies

10/25/23, 2:54 AM

Explain "enabling the CDN", as I do not know what you mean. I also do not know why someone would think 162.158.62.224 is you, so we need more detail. I have never heard of error 521, I use [this reference](https://www.rfc-editor.org/rfc/rfc9110.html#status.5xx).

mhweb

10/25/23, 10:37 AM

As noted in the original questions is a firewall and Cloudflare question. I asked in the Cloudflare forums, but they closed the question because they said it was a server problem. I mean I get a Cloudflare 521 error. Cloudflare is a CDN service for websites. I already went through the official recommendations and that's why I'm here.

Doug Smythies

10/25/23, 2:38 PM

I searched and found for myself, CDN means Content Delivery network. I also [found](https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors#521error): "Error 521 occurs when the origin web server refuses connections from Cloudflare. Security solutions at your origin may block legitimate connections from certain Cloudflare IP addresses." There might be other "UFW BLOCK" log entries with better information. A suggestion is to monitor with tcpdump (or wireshark) at the packet level to gain insight.

mhweb

10/28/23, 12:23 AM

Thanks for your replies. I'm still not able to figure out what's wrong, but I found that the htaccess has a code to block any IP from accessing the xmlrpc.php, only allowing Wordpress Jetpack to access because it requires it, but in apache logs the 162.158.x.x appear trying to access xmlrpc.php. I'm wondering if the UFW sees this and also blocks the IP in the firewall???

Doug Smythies

10/28/23, 12:31 AM

I doubt it. You would have to add your complete iptables rule set to your question for us to try help more. Note that UFW is just a front end for iptables. UFW generated iptables rules rules are difficult to read and follow. Do `sudo iptables -xvnL`.

mhweb

10/30/23, 9:31 PM

I'll provide more info later, it seems I have to set up the mod_remoteip in the apache server to restore original visitor IPs so that the server can understand the IPs coming from a proxy, in this Cloudflare.

mhweb

11/6/23, 1:36 PM

I'm still in the testing phase, but it appeared that I needed to enable the mod_remoteip module on apache2 so that the server is able to distinguish the IPs coming from the Cloudflare proxy. They call it Restoring Original Visitor IPs.

Doug Smythies

11/6/23, 2:20 PM

As described [here](https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs#C5XWe97z77b3XZV)? Interesting.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to configure UFW rules to whitelist IPs on Ubuntu web server?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.