2

I have PiVPN installed on a Raspberry Pi (Buster). I can connect from outside my network to the system without issues, I can see local devices, and the internet is routed through the device (I can surf as if I am in the network.)

However, when I run sudo apt-get update 

Err:1 http://raspbian.raspberrypi.org/raspbian buster InRelease
  Could not connect to raspbian.raspberrypi.org:80 (93.93.128.193), connection timed out
Err:2 http://archive.raspberrypi.org/debian buster InRelease
  Could not connect to archive.raspberrypi.org:80 (176.126.240.86). - connect (110: Connection timed out) Could not connect to archive.raspberrypi.org:80 (176.126.240.84), connection timed out Could not connect to archive.raspberrypi.org:80 (176.126.240.167), connection timed out Could not connect to archive.raspberrypi.org:80 (93.93.135.117), connection timed out Could not connect to archive.raspberrypi.org:80 (93.93.135.118), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.231.145), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.230.122), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.231.111), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.231.151), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.227.39), connection timed out
Reading package lists... Done
W: Failed to fetch http://raspbian.raspberrypi.org/raspbian/dists/buster/InRelease  Could not connect to raspbian.raspberrypi.org:80 (93.93.128.193), connection timed out
W: Failed to fetch http://archive.raspberrypi.org/debian/dists/buster/InRelease  Could not connect to archive.raspberrypi.org:80 (176.126.240.86). - connect (110: Connection timed out) Could not connect to archive.raspberrypi.org:80 (176.126.240.84), connection timed out Could not connect to archive.raspberrypi.org:80 (176.126.240.167), connection timed out Could not connect to archive.raspberrypi.org:80 (93.93.135.117), connection timed out Could not connect to archive.raspberrypi.org:80 (93.93.135.118), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.231.145), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.230.122), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.231.111), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.231.151), connection timed out Could not connect to archive.raspberrypi.org:80 (46.235.227.39), connection timed out
W: Some index files failed to download. They have been ignored, or old ones used instead.

Pinging an external DNS-Server ping -c 3 -W 2 8.8.8.8 doesn't work

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

UFW is installed sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
22/tcp                     ALLOW       Anywhere
1194/udp                   ALLOW       Anywhere
DNS                        ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
22 (v6)                    ALLOW       Anywhere (v6)
22/tcp (v6)                ALLOW       Anywhere (v6)
1194/udp (v6)              ALLOW       Anywhere (v6)
DNS (v6)                   ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)



Anywhere                   ALLOW OUT   Anywhere on tun0
192.168.5.0/24             ALLOW OUT   Anywhere on eth0
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on tun0

IPv4 is being forwarded sudo sysctl -p

net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Nameserver are set correct cat /etc/resolv.conf (first is PiHole, second is Router)

# Generated by resolvconf
nameserver 192.168.5.2
nameserver 192.168.5.1

ICMP rules are allowed as by default. cat /etc/ufw/before.rules

# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT

Can you give me a hint, what went wrong? Linux and Networks are not really my field of expertise.

Improve this question
2
  • Does it work when you have completely disabled the firewall?
    – Ingo
    Commented May 9, 2020 at 11:29
  • Yes, it works when the firewall is disabled. See @Ephemeral answer below. One rule had to be added to allow http port (80) out.
    – Markus
    Commented May 9, 2020 at 11:44

1 Answer 1

Reset to default
1

Try to allow DNS :

sudo ufw allow out 53

For your ping command ICMP rules is also require you can read here.

# allow outbound icmp
-A ufw-before-output -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A ufw-before-output -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

For error Failed to fetch http://... you need to allow http traffic for port 80.

sudo ufw allow out 80

After editing the file, run the command:

sudo ufw reload
Improve this answer
11
  • I allowed dns, then disabled and enabled the ufw firewall again. Still no connection.
    – Markus
    Commented May 9, 2020 at 10:28
  • please edit your question with your sudo ufw status command output
    – Ephemeral
    Commented May 9, 2020 at 10:29
  • 'then disabled and enabled the ufw firewall again' and have you check again if dns is allowed ?
    – Ephemeral
    Commented May 9, 2020 at 10:33
  • yes i did, it is now in the updated sudo ufw status above
    – Markus
    Commented May 9, 2020 at 10:52
  • 1
    sudo ufw allow out 53 was not necessary. If you want to resolve domain name into an ip addr it is require else it is not require. For example 'nslookup stackexchange.com' command line or ping domainanme.org need this rule, webbrowser need this rule etc...
    – Ephemeral
    Commented May 9, 2020 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.