UFW_DENY_OUT=TRUE blocks forwarding even with UFW_ALLOW_TO rule(s) set

[DragonPi]

Hi everyone,

It's probably something I'm missing but when I activate the UFW_DENY_OUT forwarding stops even with an UFW_ALLOW_TO rule set.

example for a container I'm planning to use as a bastion jumpserver:

    ports:
      - 8022:22/tcp
    labels:
      UFW_MANAGED: "TRUE"
      UFW_ALLOW_FROM: "192.168.1.1-8022-ROUTER"
      UFW_DENY_OUT: "TRUE"
      UFW_ALLOW_TO: "192.168.1.0/24-22-LAN"

results in:

sudo ufw status numbered
Status: active
     To                         Action      From
     --                         ------      ----
*snip*
[10] 172.25.0.2 8022/tcp        ALLOW FWD   192.168.1.1                # bastion:5a099f0cde70 ROUTER
[11] 192.168.1.0/24 22          ALLOW FWD   172.25.0.2                 # bastion:5a099f0cde70 LAN
[12] Anywhere                   DENY FWD    172.25.0.2                 # bastion:5a099f0cde70
*snip*

which seems okay(ish?) but I have doubts...

• rule 10 seems to suggest the container listens on port 8022, but that's not correct, the hosts port 8022 is bound to 22 from the container as you can see
• rule 11 seems ok as the containers IP is allowed to forward traffic to port 22 on host on my local network
• rule 12 suggests all other forward traffic from the containers ip is blocked

To be clear: this config is not working unless I set UFW_DENY_OUT to FALSE.
Also changing UFW_ALLOW_FROM: "192.168.1.1-8022-ROUTER" to UFW_ALLOW_FROM: "192.168.1.1-22-ROUTER" is not working alltough it changes the rule to [10] 172.25.0.2 22/tcp ALLOW FWD 192.168.1.1 # bastion:03cee83a4b0b ROUTER

Am I interpreting the output from ufw correctly?
Can somebody shed a light on what to set as config parameters?

Goal is: 192.168.1.1 should be allowed to contact port 8022. The containers has port 22 activated and should forward the traffic to my local network hosts to port 22

And by the way thanks for all the effort already put into place!

regards,
Koen

[DragonPi]

Since my earlier post I tried different things, but to no avail.

I'm now wondering if this is a bug? But then again I would imagine that others must have encountered that same issue before?
So if nobody else is facing this same issue, it still must be something I'm doing wrong.

Isn't there somebody that has a clue?

regards,
Koen