# Open firewall (UFW) on Linux host only for traffic from ziti tunnel

**URL:** <https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512>\
**Category:** Ziti Tunnel\
**Created:** [August 16, 2023, 6:57pm UTC](https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512 "2023-08-16T18:57:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Metz](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Metz](https://openziti.discourse.group/u/Metz)\
**Post date:** [August 16, 2023, 6:57pm UTC](https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512/1 "2023-08-16T18:57:29Z")

</div>

Hello,

I do have a server which is running on the public internet and actual I do only allow ssh incoming traffic from my public source IP.  
( sudo ufw allow from {my\_source\_ip} to {my\_server\_ip} port 22 proto tcp comment ‘Allow SSH’ )

Now I’ve installed ziti tunneler on the linux host and like to change the firewall rule to allow also incoming traffic from the tunnel to the ssh port. How can I do this without allowing the whole internet?

Can I use the tunnel interface or the IP of the tunnel? Or is it still the real source ip?

```auto
tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 100.64.0.1/32 scope global tun0
       valid_lft forever preferred_lft forever

```

I tried to capture packets with tcpdump but somehow was not able to capture packets.

Many Thanks  
Metz

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [August 16, 2023, 7:05pm UTC](https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512/2 "2023-08-16T19:05:53Z")

</div>

Hi @Metz, welcome to the community and to OpenZiti!

If you installed the tunneler on the linux host, I would expect you would be effectively using the equivalent of "ssh localhost" and I don't _think_ that's denied by default. I'll have to google around to figure out if ufw is blocking even "localhost" connections. When I use ziti-edge-tunnel to ssh, I setup the offload of the service to 127.0.0.1 and not the public ip address. That way you don't need to modify the firewall. Does that make sense?

> [@Metz](#):
>
> Can I use the tunnel interface or the IP of the tunnel? Or is it still the real source ip?

So instead of the real IP or the tun IP, I say use "127.0.0.1". Then on your local machine, you would do something like "ssh my.server.over.ziti" (the intercept side configuration) which would tunnel through ziti to the ziti-edge-tunnel on that linux server and offload from the tunneler towards 127.0.0.1:22.

Hopefully that makes sense and hopefully I understood your question correctly

---

<div class="post-metadata">

**Author:** ![Metz](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Metz](https://openziti.discourse.group/u/Metz)\
**Post date:** [August 16, 2023, 7:13pm UTC](https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512/3 "2023-08-16T19:13:18Z")

</div>

Hi @TheLumberjack, thank you for the quick answer.

That sounds feasable. I didn’t think about that. The loopback 127.0.0.1 is anyway open.

I’ll will test and let you know. But first I need to figure out why my server does not connect anymore after I changed the IP address of the server.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [August 16, 2023, 7:19pm UTC](https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512/4 "2023-08-16T19:19:13Z")

</div>

> [@Metz](#):
>
> But first I need to figure out why my server does not connect anymore after I changed the IP address of the server.

I don't think I can help you there! 🙂

I'm certain offloading to 127.0.0.1 works since I've done it numerous times. Let us know if you get tripped up somewhere and we'll get you sorted.

---

<div class="post-metadata">

**Author:** ![Metz](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Metz](https://openziti.discourse.group/u/Metz)\
**Post date:** [August 16, 2023, 8:39pm UTC](https://openziti.discourse.group/t/open-firewall-ufw-on-linux-host-only-for-traffic-from-ziti-tunnel/1512/5 "2023-08-16T20:39:31Z")

</div>

Perfect. It worked. Thank you for your great support!!!