我已按以下方式配置ufw。令人费解的是，我指示阻止出站和入站的端口却连接上了。为什么？
我当前的 ufw 配置与通过ss -t命令打开端口：
To Action From
-- ------ ----
[ 1] 25,53,80,110,443/tcp ALLOW OUT Anywhere (out)
[ 2] 53,67,68/udp ALLOW OUT Anywhere (out)
[ 3] 51413/tcp ALLOW OUT Anywhere (out)
[ 4] 51413/udp ALLOW OUT Anywhere (out)
[ 5] 6969/tcp ALLOW OUT Anywhere (out)
[ 6] 1194/udp ALLOW OUT Anywhere (out)
[ 7] 1:24/tcp DENY IN Anywhere
[ 8] 26:52/tcp DENY IN Anywhere
[ 9] 54:79/tcp DENY IN Anywhere
[10] 81:109/tcp DENY IN Anywhere
[11] 111:442/tcp DENY IN Anywhere
[12] 444:6968/tcp DENY IN Anywhere
[13] 6970:51412/tcp DENY IN Anywhere
[14] 51414:65535/tcp DENY IN Anywhere
[15] 1:52/udp DENY IN Anywhere
[16] 53:66/udp DENY IN Anywhere
[17] 69:1193/udp DENY IN Anywhere
[18] 1195:51412/udp DENY IN Anywhere
[19] 51414:65535/udp DENY IN Anywhere
[20] 22 DENY IN Anywhere
[21] 48567/tcp DENY IN Anywhere
[22] 1194 ALLOW IN 46.246.37.162
[23] 1:24/tcp DENY OUT Anywhere (out)
[24] 26:52/tcp DENY OUT Anywhere (out)
[25] 54:79/tcp DENY OUT Anywhere (out)
[26] 81:109/tcp DENY OUT Anywhere (out)
[27] 111:142/tcp DENY OUT Anywhere (out)
[28] 444:6968/tcp DENY OUT Anywhere (out)
[29] 6970:51412/tcp DENY OUT Anywhere (out)
[30] 51414:65535/tcp DENY OUT Anywhere (out)
[31] 1:52/udp DENY OUT Anywhere (out)
[32] 53:66/udp DENY OUT Anywhere (out)
[33] 68:1193/udp DENY OUT Anywhere (out)
[34] 1195:51412/udp DENY OUT Anywhere (out)
[35] 51414:65535/udp DENY OUT Anywhere (out)
[36] 22/udp DENY OUT Anywhere (out)
[37] 25/tcp DENY IN Anywhere
[38] 53,80,110,443/tcp DENY IN Anywhere
[39] 53,67,68/udp DENY IN Anywhere
[40] 51413/tcp DENY IN Anywhere
[41] 51413/udp DENY IN Anywhere
[42] 6969/tcp DENY IN Anywhere
[43] 1194/udp DENY IN Anywhere
[44] 32968/tcp DENY IN Anywhere
[45] 32968/tcp DENY OUT Anywhere (out)
[46] 41748/tcp DENY IN Anywhere
[47] 41748/tcp DENY OUT Anywhere (out)
[48] 25,53,80,110,443/tcp (v6) ALLOW OUT Anywhere (v6) (out)
[49] 53,67,68/udp (v6) ALLOW OUT Anywhere (v6) (out)
[50] 51413/tcp (v6) ALLOW OUT Anywhere (v6) (out)
[51] 51413/udp (v6) ALLOW OUT Anywhere (v6) (out)
[52] 6969/tcp (v6) ALLOW OUT Anywhere (v6) (out)
[53] 1194/udp (v6) ALLOW OUT Anywhere (v6) (out)
[54] 1:24/tcp (v6) DENY IN Anywhere (v6)
[55] 26:52/tcp (v6) DENY IN Anywhere (v6)
[56] 54:79/tcp (v6) DENY IN Anywhere (v6)
[57] 81:109/tcp (v6) DENY IN Anywhere (v6)
[58] 111:442/tcp (v6) DENY IN Anywhere (v6)
[59] 444:6968/tcp (v6) DENY IN Anywhere (v6)
[60] 6970:51412/tcp (v6) DENY IN Anywhere (v6)
[61] 51414:65535/tcp (v6) DENY IN Anywhere (v6)
[62] 1:52/udp (v6) DENY IN Anywhere (v6)
[63] 53:66/udp (v6) DENY IN Anywhere (v6)
[64] 69:1193/udp (v6) DENY IN Anywhere (v6)
[65] 1195:51412/udp (v6) DENY IN Anywhere (v6)
[66] 51414:65535/udp (v6) DENY IN Anywhere (v6)
[67] 22 (v6) DENY IN Anywhere (v6)
[68] 48567/tcp (v6) DENY IN Anywhere (v6)
[69] 1:24/tcp (v6) DENY OUT Anywhere (v6) (out)
[70] 26:52/tcp (v6) DENY OUT Anywhere (v6) (out)
[71] 54:79/tcp (v6) DENY OUT Anywhere (v6) (out)
[72] 81:109/tcp (v6) DENY OUT Anywhere (v6) (out)
[73] 111:142/tcp (v6) DENY OUT Anywhere (v6) (out)
[74] 444:6968/tcp (v6) DENY OUT Anywhere (v6) (out)
[75] 6970:51412/tcp (v6) DENY OUT Anywhere (v6) (out)
[76] 51414:65535/tcp (v6) DENY OUT Anywhere (v6) (out)
[77] 1:52/udp (v6) DENY OUT Anywhere (v6) (out)
[78] 53:66/udp (v6) DENY OUT Anywhere (v6) (out)
[79] 68:1193/udp (v6) DENY OUT Anywhere (v6) (out)
[80] 1195:51412/udp (v6) DENY OUT Anywhere (v6) (out)
[81] 51414:65535/udp (v6) DENY OUT Anywhere (v6) (out)
[82] 22/udp (v6) DENY OUT Anywhere (v6) (out)
[83] 25/tcp (v6) DENY IN Anywhere (v6)
[84] 53,80,110,443/tcp (v6) DENY IN Anywhere (v6)
[85] 53,67,68/udp (v6) DENY IN Anywhere (v6)
[86] 51413/tcp (v6) DENY IN Anywhere (v6)
[87] 51413/udp (v6) DENY IN Anywhere (v6)
[88] 6969/tcp (v6) DENY IN Anywhere (v6)
[89] 1194/udp (v6) DENY IN Anywhere (v6)
[90] 32968/tcp (v6) DENY IN Anywhere (v6)
[91] 32968/tcp (v6) DENY OUT Anywhere (v6) (out)
[92] 41748/tcp (v6) DENY IN Anywhere (v6)
[93] 41748/tcp (v6) DENY OUT Anywhere (v6) (out)
在ss -t命令输出中，我用 替换了我的 IP 地址00.000.00.000。重要的是，明显关闭的端口显然是打开并正在连接：为什么？
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 00.000.00.000:37511 64.233.161.189:https
ESTAB 0 0 00.000.00.000:35895 83.140.66.19:https
ESTAB 0 0 00.000.00.000:57047 198.252.206.25:https
ESTAB 0 0 00.000.00.000:38515 127.0.0.1:openvpn
ESTAB 0 0 00.000.00.000:50483 104.16.110.188:https
ESTAB 0 0 000.000.00.000:37515 104.16.90.254:https
ESTAB 0 0 00.000.00.000:57391 104.16.104.204:https
ESTAB 0 0 00.000.00.000:41273 31.13.71.7:https
ESTAB 0 0 00.000.00.000:openvpn 127.0.0.1:38515
ESTAB 0 0 00.000.00.000:40040 173.252.88.66:https
ESTAB 0 0 00.000.00.000:57155 198.252.206.25:https
ESTAB 0 0 00.000.00.000:35896 83.140.66.19:https
ESTAB 0 0 00.000.00.000:40034 173.252.88.66:https
ESTAB 0 0 00.000.00.000:57680 127.0.0.1:34330
ESTAB 0 0 00.000.00.000:34330 127.0.0.1:57680
ESTAB 0 0 00.000.00.000:55154 104.16.113.188:http
ESTAB 0 0 46.246.62.216:57173 198.252.206.25:https
ESTAB 0 0 00.000.00.000:41272 31.13.71.7:https
CLOSE-WAIT 1 0 ::1:57751 ::1:ipp
CLOSE-WAIT 1 0 ::1:57752 ::1:ipp
CLOSE-WAIT 1 0 ::1:57755 ::1:ipp
tarique@tarique-All-Series:~$
答案1
使用命令检查默认 ufw 设置
sudo ufw status verbose
保持默认设置拒绝传入和传出的运行命令：
sudo ufw default deny incoming
sudo ufw default deny outgoing
或者
打开文件/etc/default/ufw
vi /etc/default/ufw
并更改默认设置
DEFAULT_INPUT_POLICY="DROP"
DEFAULT_OUTPUT_POLICY="DROP"