UFW is blocking the selfhosted Discovery Server


#1

I run my own relay and discovery server on my server. Both services run behind a firewall (UFW) and the ports are open.

The relay server (port 8014) works fine. However, UFW blocks the Discovery Server on port 8015. Clients only appear for a short time and disappear again

I hope you can give me a hint.

netstat -anp | grep 8014 (Relay Server --> works)

tcp        0      0 SERVER_IP:53600     SERVER_IP:8014     VERBUNDEN       2300/syncthing
tcp6       0      0 :::8014             :::*               LISTEN      1063/strelaysrv
tcp6       0      0 SERVER_IP:8014      CLIENT_1:32512     VERBUNDEN   1063/strelaysrv
tcp6       0      0 SERVER_IP:8014      CLIENT_2:46726     VERBUNDEN   1063/strelaysrv
tcp6       0      0 SERVER_IP:8014      CLIENT_3:32263     VERBUNDEN   1063/strelaysrv

netstat -anp | grep 8015 (Discovery Server --> Clients disappear or getting blocked)

tcp6       0      0 :::8015             :::*                LISTEN      1101/stdiscosrv
tcp6       0      0 SERVER_IP:8015      CLIENT_1:56660      VERBUNDEN   1101/stdiscosrv

Client_1 Syncthing Log:

INFO: SERVER_HASH at 192.168.1.6:57702-SERVER_IP:22000/tcp-client closed: reading length: read tcp 192.168.1.6:57702->SERVER_IP:22000: read: connection reset by peer

UFW Log:

SERVER kernel: [UFW BLOCK] IN=eth0 OUT= MAC= SRC=CLIENT_1 DST=SERVER_IP 
LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=56714 DPT=8015 WINDOW=0 RES=0x00 RST URGP=0

ufw status verbose

Status: active
Logging: on (high)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   DENY IN     SERVER_IP
22000/tcp                  ALLOW IN    Anywhere
8014/tcp                   ALLOW IN    Anywhere
8015/tcp                   ALLOW IN    Anywhere
22000/tcp (v6)             ALLOW IN    Anywhere (v6)
8014/tcp (v6)              ALLOW IN    Anywhere (v6)
8015/tcp (v6)              ALLOW IN    Anywhere (v6)

(Audrius Butkevicius) #2

Sorry but this is very confusing. You say that you run a relay, post logs of a device, yet explain that discovery doesn’t work. I am not sure whats the relevance of all 3 components to the problem. If discovery fails, post logs of discovery failing on the client.


(Audrius Butkevicius) #3

Also, the device logs show an attempt for a direct connection, so not sure how is that even relevant.