Hetzner Robo outgoing traffic is not reaching some IPs

hetzner_outgoing_traffic.md

Hetzner stroking on some TCP outgoing traffic

My Robo server can access some IPs, but not some others. Weird!

Adding explicit TCP outgoing allow rules (fail)

I explicitely enabled outgoing IPv4 TCP + UDP traffic. Four entries in total:

• IPv4 TCP
• IPv4 UDP
• IPv6 TCP
• IPv6 UDP

Doesn't look like it did anything.

I just restarted the server, waiting for it to come back up...

It didn't help.

Updating the software (fail)

apt update

... of course, that doesn't work, because I can't access half of the IPs.

Disabling the firewall (medium success)

Disabling the firewall solves the issue!

Using a firewall template and tweaking it (true success)

I am using the "SSH" firewall template.

I also added my custom SSH rule (deny outgoing TCP 5555 to the Internet).

It worked!

It also works connections to port 5555.

Final firewall configuration (steal it!)

Here is the configuration I ended up with.

Note that everything here is default from the "SSH" template, except the "ADB"/"port 555" rule.

EDIT: allowing DNS traffic

One problem: outgoing DNS requests to Internet resolvers fail, because the UDP response packets don't reach my server.

DNS works like this:

• an UDP packet is sent
• an UDP packet is received

There is no "connection". Hetzner's firewall apparently doesn't keep track of DNS requests.

From what I can see, the response packet is sent in response to the source port of the UDP packet. This port is always high, but I'm too lazy to figure out the range. I am thus allowing all incoming UDP traffic to my machine.

Conclusion

The main difference seems that the template allows "TCP established" packets to be received, with flag set to "ack".

I am a bit surprised, given that I didn't know this was a requirement.

There is so much I have to learn still...