I ufw deny 53, but an nc scan reports a successful connection

u20200411 asked:

Why is an nc scan able to successfully connect with port 53 when I’ve denied it through ufw?

I noticed port 53 is listening:

$ sudo ss -tulpne 

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
udp UNCONN 0 0 users:(("avahi-daemon",pid=514,fd=12)) uid:115 ino:18620 sk:1 <->
udp UNCONN 0 0 users:(("systemd-resolve",pid=356,fd=12)) uid:102 ino:15766 sk:2 <->
udp UNCONN 0 0 users:(("NetworkManager",pid=538,fd=19)) ino:21287 sk:3 <->
udp UNCONN 0 0 users:(("avahi-daemon",pid=514,fd=14)) uid:115 ino:18622 sk:4 <->
udp UNCONN 0 0 users:(("cups-browsed",pid=571,fd=7)) ino:18922 sk:5 <->
udp UNCONN 0 0 users:(("systemd-timesyn",pid=355,fd=16)) uid:100 ino:41918 sk:6 <->
udp UNCONN 0 0 [::]:5353 [::]: users:(("avahi-daemon",pid=514,fd=13)) uid:115 ino:18621 sk:7 v6only:1 <->
udp UNCONN 0 0 [::]:38831 [::]: users:(("avahi-daemon",pid=514,fd=15)) uid:115 ino:18623 sk:8 v6only:1 <->
tcp LISTEN 0 128 users:(("systemd-resolve",pid=356,fd=13)) uid:102 ino:15767 sk:9 <->
tcp LISTEN 0 5 users:(("cupsd",pid=487,fd=7)) ino:18380 sk:a <->
tcp LISTEN 0 5 [::1]:631 [::]:* users:(("cupsd",pid=487,fd=6)) ino:18379 sk:b v6only:1 <->

So I close that port through the ufw:

$ sudo ufw deny 53
$ sudo ufw status verbose
Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip
To Action From
53 DENY IN Anywhere
53 (v6) DENY IN Anywhere (v6)

And when I do an nc scan, I see a successful connection with the port:

$ sudo nc -zv 50-53
nc: connect to port 50 (tcp) failed: Connection refused 
nc: connect to port 51 (tcp) failed: Connection refused 
nc: connect to port 52 (tcp) failed: Connection refused 
Connection to 53 port [tcp/domain] succeeded!

I expected the firewall to prevent this connection

Why is the firewall not preventing the connection? Please help me correct my thinking

SIDENOTE: I know port 53 is used by dnsmasqd and that there are many good reasons to keep the port open. But in this question, I am solely concerned with the effective closing of ports through the firewall. I also know I can prevent this port from listening by editing /etc/systemd/resolved.conf

My answer:

ufw does not block any localhost connections. These are always allowed.

View the full question and any other answers on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.