Ubuntu

Cannot find ufw rules that will allow a USB Gadget internet access

Asked by JensOtto

I have a raspberry Pi Zero configured as a USB Gadget and it is working very well, except that when I have the ufw enabled on the host PC I cannot access the Internet from an SSH session to the USB Gadget.

My setup is as follows: I'm running Ubuntu 23.04 on an Intel NUC 10i5 and that PC has an IP address (DHCP assigned) in the range 192.168.87.xxx
I've followed the advice from https://dev.webonomic.nl/connecting-to-a-raspberry-pi-zero-with-just-an-usb-cable-ii and configured static IP addresses on "both sides" of the USB Gadget. This is working.

The USB Gadget (Raspberry Pi Zero) is running Raspbian GNU/Linux 10 (buster) and it reports its IP address as 10.42.0.29
On the PC side the usb0 network interface has IP address 10.42.0.1

Regardless of whether ufw is enabled or disabled I can ping 10.42.0.1 and .29 and I can SSH to 10.42.0.29 from the host PC.
But there's no Internet connection from the SSH session to the USB Gadget if ufw is running on the host PC but there is a working Internet connection if ufw is disabled on the host PC
Currently I have these (default) rules on the host PC
$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

when I try to access the Internet from the USB Gadget when the ufw is enabled on the host PC I can on the PC see something like this:
$ sudo tail -f /var/log/ufw.log
2023-06-01T15:40:03.671461+02:00 Emma kernel: [24099.066087] [UFW BLOCK] IN=usb0 OUT=eno1 MAC=e2:4b:30:68:5e:fd:9xxxxxx SRC=10.42.0.29 DST=8.8.8.8 LEN=67 TOS=0x00 PREC=0x00 TTL=63 ID=47230 DF PROTO=UDP SPT=60485 DPT=53 LEN=47

I've tried adding many rules to ufw but I cannot simultaneously get Internet access from the USB Gadget and have an enabled ufw on the host PC. Any suggestions -- is it as simple as allowing routing -- and how is that done?

Thanks in advance.

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
Manfred Hampl
Solved:
Last query:
Last reply:
Revision history for this message
Best Manfred Hampl (m-hampl) said : 		#1

What happens if you try the reverse access, i.e. ssh-ing from the Pi to your PC (10.42.0.1). What log messages from USW do you get for that?

Have you tried adding a rule to allow the items that are listed in the log message above

In your case perhaps
       ufw allow in on usb0
or
       ufw route allow in on usb0

(see the man pages for details about the commands; don't forget to reload ufw after each rule change)

Revision history for this message
Bernard Stafford (bernard010) said : 		#2

https://help.ubuntu.com/community/UFW
Look at "Allow by specific port, IP address and protocol" section.
sudo ufw allow from 192.168.0.4 to any port 22 proto tcp - Example, make for ssh

Revision history for this message
JensOtto (jos-ideatore) said : 		#3

@ m-hampl
ufw allow in on usb0 doesn't give Internet access
However

sudo ufw route allow in on usb0

did the trick! Thank you very much.

@benard010
Thank you for your suggestion -- I have tried a number of variations of this but that doesn't really do what I want. Probably due to my lack of knowledge of how to use ufw

Revision history for this message
JensOtto (jos-ideatore) said : 		#4

Thanks Manfred Hampl, that solved my question.