UFW blocks outgoing connections to another server because the default policy for outbound traffic is often set to deny, or specific rules are missing. To resolve this, verify that the UFW status shows "active" and check the rule list to ensure there is an allow rule for the destination port or IP address of the target server.
Understanding UFW Default Policies
The Uncomplicated Firewall (UFW) manages netfilter firewall rules in a user-friendly way. By default, on many Ubuntu installations, the incoming traffic policy is set to
deny while the outgoing traffic policy is set to
allow. However, if you have previously modified these policies, or if you are using a minimal installation where defaults were changed, your outgoing connections might be blocked. This is the most common reason why SSH works (incoming connection allowed) but connecting to another server fails (outgoing connection blocked). You can check the current default policies by running
sudo ufw status verbose. Look for lines stating "Default: deny (incoming), allow (outgoing)" or similar. If outgoing is denied, you need to change it or add explicit rules.
Checking Existing Rules
Before adding new rules, it is crucial to see what is currently configured. Run
sudo ufw status numbered to see all active rules with their index numbers. This output helps you identify if there is already a rule allowing traffic to the specific IP or port of the other server. If you see a rule like
ALLOW IN 22/tcp, it permits incoming SSH but says nothing about outgoing connections. If you see a rule denying all outgoing traffic, that is the culprit. You can also check for any rules specifically targeting the IP address of the other server. For example, if the other server is at
192.168.1.50, look for rules involving that IP. If no such rule exists, and outgoing is denied, you must create one.
Adding Outbound Rules
If the default outgoing policy is deny, you can either change the default policy or add specific rules. Changing the default is safer if you trust all outgoing traffic from this machine. Use
sudo ufw default allow outgoing to set the default policy to allow. Then, reload the firewall with
sudo ufw reload. Alternatively, if you want granular control, add a rule for the specific destination. For instance, to allow SSH to a specific server at
192.168.1.50, use
sudo ufw allow out to 192.168.1.50 port 22 proto tcp. This command explicitly permits outbound TCP traffic on port 22 to that IP. Replace the IP and port as needed for your use case.
Testing Connectivity
After adjusting the rules, test the connection again. Try pinging the other server using
ping 192.168.1.50 to check basic network reachability. If ping works but SSH still fails, the issue might be application-specific. Try connecting via SSH again with
ssh [email protected]. If you encounter a timeout, the firewall is likely still blocking the traffic. Check the UFW logs for dropped packets. Logs are located in
/var/log/ufw.log. Use
sudo tail -f /var/log/ufw.log while attempting the connection to see if UFW is logging denied packets. If you see entries like
DROP OUT, the rule was not applied correctly or the policy is still deny.
Debugging with Verbose Output
If the connection still fails, enable verbose logging temporarily. Run
sudo ufw logging on. This increases the verbosity of UFW logs, helping you pinpoint exactly which rule is being evaluated. After testing, remember to turn off verbose logging to avoid log clutter with
sudo ufw logging off. Also, ensure that the other server's firewall allows incoming connections from your Ubuntu machine. Sometimes, the problem is not on your end but on the remote server's configuration. Check the remote server's firewall rules as well.
Common Pitfalls
One common mistake is forgetting to enable UFW after installing it. If UFW is inactive, it does not filter traffic, but if it is active and misconfigured, it breaks connectivity. Another pitfall is assuming that allowing incoming SSH automatically allows outgoing SSH. These are separate directions. Additionally, if you are using NAT or complex routing, UFW rules might need to account for source and destination IPs differently. For more details on managing UFW policies, see our guide on
Kubuntu UFW: Block Incoming, Allow Outgoing. This resource explains how to balance security with functionality.
Reloading Configuration
Always reload UFW after making changes to ensure they take effect. Use
sudo ufw reload. This command restarts the firewall daemon without dropping existing connections abruptly. It applies the new rules immediately. If you do not reload, old rules may persist until the next reboot, leading to confusion during troubleshooting.
Frequently Asked Questions
Why does UFW block outgoing traffic by default?
Some minimal or hardened installations set the default outgoing policy to deny for maximum security. This ensures that only explicitly allowed applications can initiate connections. It prevents malware from phoning home or data exfiltration. Always verify your default policies after installation.
How do I allow all outgoing traffic?
Run
sudo ufw default allow outgoing followed by
sudo ufw reload. This sets the global default for outbound connections to accept. Be cautious, as this reduces security by allowing any application to connect externally. Only use this if you trust all software on the system.
What if the other server is unreachable via ping?
If ping fails, the issue is likely network-related, not just UFW. Check your local network configuration, DNS settings, and routing table. Ensure you have correct IP addresses and subnet masks. Contact your network administrator if you suspect broader connectivity issues.
Can I allow outgoing traffic only for specific ports?
Yes, you can add rules like
sudo ufw allow out to any port 80 proto tcp. This allows HTTP traffic but blocks other protocols. Combine this with a deny default outgoing policy for strict control. Review each rule carefully to avoid unintended access.
Where are UFW logs stored?
Logs are typically found in
/var/log/ufw.log or
/var/log/syslog depending on your syslog configuration. Use
grep ufw /var/log/syslog to search for UFW entries. Enable logging with
sudo ufw logging on if it is currently disabled. Analyze logs to identify dropped packets and adjust rules accordingly.