Linux

58266 readers

691 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 6 years ago

MODERATORS

AgreeableLandscape@lemmy.ml

nooter692@lemmy.ml

MarcellusDrum@lemmy.ml

cypherpunks@lemmy.ml

cyclohexane@lemmy.ml

d3Xt3r@lemmy.nz

UFW compatibility issues with my VPN (lemmy.dbzer0.com)

submitted 1 week ago by aprehendedmerlin@lemmy.dbzer0.com to c/linux@lemmy.ml

8 comments fedilink hide all child comments

Hi all—as title suggests I'm experiencing a compatibility issue between UFW and my vpn (Windscribe if it matters). My UFW defaults are set to deny incoming, allow outgoing, and routed disabled, with no exception rules configured. When I enable Windscribe (I use OpenVPN udp on port 80 if that matters) while UFW is active, Windscribe reports a network configuration error and requests sending debug logs; ignoring the error still allows the VPN to function, but I observe IPv6 and DNS leaks. Disabling UFW removes the error and the leaks. What UFW configuration is causing this behavior, and which specific rules should I add to prevent IPv6 and DNS leaks while keeping UFW enabled?

you are viewing a single comment's thread
view the rest of the comments

[–] drspod@lemmy.ml 5 points 1 week ago (2 children)

It might help if you paste a complete dump of your firewall rules. I'm not sure if ufw uses iptables of netfilter since I haven't used it before, but you can do:

for iptables firewalls:

iptables -L

for netfilter firewalls:

nft list ruleset

That might help debug exactly what ufw and your vpn are doing.

[–] non_burglar@lemmy.world 1 points 1 week ago

Iptables (and nftables, among others) is just an implementation of netfilter kernel modules.

[+] aprehendedmerlin@lemmy.dbzer0.com 0 points 1 week ago (1 children)

[deleted]

[–] drspod@lemmy.ml 3 points 1 week ago (3 children)

Thanks, looking at it now, but I should have remembered, iptables has a separate tool for ipv6 called ip6tables. Could you also paste the output of

ip6tables -L

If you put it in the comment between backticks like this:

```

```

then it will keep the formatting exactly as it was when you copied it, instead of munging the linebreaks.

[–] aprehendedmerlin@lemmy.dbzer0.com 1 points 1 week ago (1 children)

ok thank you for your time here is the output of ip6tables -L:

Chain INPUT (policy DROP) target prot opt source destination
ufw6-before-logging-input all -- anywhere anywhere
ufw6-before-input all -- anywhere anywhere
ufw6-after-input all -- anywhere anywhere
ufw6-after-logging-input all -- anywhere anywhere
ufw6-reject-input all -- anywhere anywhere
ufw6-track-input all -- anywhere anywhere
windscribe_input all -- anywhere anywhere /* Windscribe client rule */
Chain FORWARD (policy DROP) target prot opt source destination
ufw6-before-logging-forward all -- anywhere anywhere
ufw6-before-forward all -- anywhere anywhere
ufw6-after-forward all -- anywhere anywhere
ufw6-after-logging-forward all -- anywhere anywhere
ufw6-reject-forward all -- anywhere anywhere
ufw6-track-forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT) target prot opt source destination
ufw6-before-logging-output all -- anywhere anywhere
ufw6-before-output all -- anywhere anywhere
ufw6-after-output all -- anywhere anywhere
ufw6-after-logging-output all -- anywhere anywhere
ufw6-reject-output all -- anywhere anywhere
ufw6-track-output all -- anywhere anywhere
windscribe_output all -- anywhere anywhere /* Windscribe client rule */
Chain ufw6-after-forward (1 references) target prot opt source destination
Chain ufw6-after-input (1 references) target prot opt source destination
ufw6-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns ufw6-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm ufw6-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn ufw6-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds ufw6-skip-to-policy-input udp -- anywhere anywhere udp dpt:dhcpv6-client ufw6-skip-to-policy-input udp -- anywhere anywhere udp dpt:dhcpv6-server
Chain ufw6-after-logging-forward (1 references) target prot opt source destination
Chain ufw6-after-logging-input (1 references) target prot opt source destination
Chain ufw6-after-logging-output (1 references) target prot opt source destination
Chain ufw6-after-output (1 references) target prot opt source destination
Chain ufw6-before-forward (1 references) target prot opt source destination
DROP all -- anywhere anywhere rt type:0 ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp destination-unreachable ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp packet-too-big ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp time-exceeded ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp parameter-problem ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp echo-request ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp echo-reply ufw6-user-forward all -- anywhere anywhere
Chain ufw6-before-input (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere rt type:0 ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp echo-reply ufw6-logging-deny all -- anywhere anywhere ctstate INVALID DROP all -- anywhere anywhere ctstate INVALID ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp destination-unreachable ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp packet-too-big ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp time-exceeded ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp parameter-problem ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp echo-request ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp router-solicitation HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp router-advertisement HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp neighbour-solicitation HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp neighbour-advertisement HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 141 HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 142 HL match HL == 255 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmp mld-listener-query ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmp mld-listener-report ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmp mld-listener-done ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 143 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 148 HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 149 HL match HL == 255 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 151 HL match HL == 1 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 152 HL match HL == 1 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 153 HL match HL == 1 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 144 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 145 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 146 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 147 ACCEPT udp -- fe80::/10 fe80::/10 udp spt:dhcpv6-server dpt:dhcpv6-client ACCEPT udp -- anywhere ff02::fb udp dpt:mdns ACCEPT udp -- anywhere ff02::f udp dpt:1900 ufw6-user-input all -- anywhere anywhere
Chain ufw6-before-logging-forward (1 references) target prot opt source destination
Chain ufw6-before-logging-input (1 references) target prot opt source destination
Chain ufw6-before-logging-output (1 references) target prot opt source destination
Chain ufw6-before-output (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere rt type:0 ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp destination-unreachable ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp packet-too-big ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp time-exceeded ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp parameter-problem ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp echo-request ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp echo-reply ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp router-solicitation HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp neighbour-advertisement HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp neighbour-solicitation HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmp router-advertisement HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 141 HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 142 HL match HL == 255 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmp mld-listener-query ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmp mld-listener-report ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmp mld-listener-done ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 143 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 148 HL match HL == 255 ACCEPT ipv6-icmp -- anywhere anywhere ipv6-icmptype 149 HL match HL == 255 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 151 HL match HL == 1 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 152 HL match HL == 1 ACCEPT ipv6-icmp -- fe80::/10 anywhere ipv6-icmptype 153 HL match HL == 1 ufw6-user-output all -- anywhere anywhere
Chain ufw6-logging-allow (0 references) target prot opt source destination
Chain ufw6-logging-deny (1 references) target prot opt source destination
Chain ufw6-reject-forward (1 references) target prot opt source destination
Chain ufw6-reject-input (1 references) target prot opt source destination
Chain ufw6-reject-output (1 references) target prot opt source destination
Chain ufw6-skip-to-policy-forward (0 references) target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw6-skip-to-policy-input (6 references) target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw6-skip-to-policy-output (0 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw6-track-forward (1 references) target prot opt source destination
Chain ufw6-track-input (1 references) target prot opt source destination
Chain ufw6-track-output (1 references) target prot opt source destination
ACCEPT tcp -- anywhere anywhere ctstate NEW ACCEPT udp -- anywhere anywhere ctstate NEW
Chain ufw6-user-forward (1 references) target prot opt source destination
Chain ufw6-user-input (1 references) target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:22000 /* 'dapp_syncthing' / ACCEPT udp -- anywhere anywhere udp dpt:22000 / 'dapp_syncthing' / ACCEPT udp -- anywhere anywhere udp dpt:21027 / 'dapp_syncthing' */ ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:10387 ACCEPT udp -- anywhere anywhere udp dpt:10387
Chain ufw6-user-limit (0 references) target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp6-port-unreachable
Chain ufw6-user-limit-accept (0 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw6-user-logging-forward (0 references) target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw6-user-logging-input (0 references) target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw6-user-logging-output (0 references) target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw6-user-output (1 references) target prot opt source destination
Chain windscribe_input (1 references) target prot opt source destination
ACCEPT all -- ip6-localhost anywhere /* Windscribe client rule / DROP all -- anywhere anywhere / Windscribe client rule */
Chain windscribe_output (1 references) target prot opt source destination
ACCEPT all -- anywhere ip6-localhost /* Windscribe client rule / DROP all -- anywhere anywhere / Windscribe client rule */

[–] drspod@lemmy.ml 1 points 1 week ago (1 children)

Sorry to be a doofus, but could you paste the output of iptables-save and ip6tables-save instead? The default iptables output actually just leaves out important information like which interface the rule applies to.

I think the best thing to do would be to see if you can get support from Windscribe and find out whether it's a known issue or a bug that needs fixing.

[–] aprehendedmerlin@lemmy.dbzer0.com 1 points 1 week ago

I did they said it just how their app is made and I should disable ufw

[–] aprehendedmerlin@lemmy.dbzer0.com 1 points 1 week ago

also here is the output of iptables -L again with markdown:

Chain INPUT (policy DROP) target prot opt source destination
windscribe_input all -- anywhere anywhere /* Windscribe client rule / ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere
windscribe_block all -- anywhere anywhere / Windscribe client rule */
Chain FORWARD (policy DROP) target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT) target prot opt source destination
windscribe_output all -- anywhere anywhere /* Windscribe client rule / windscribe_dnsleaks all -- anywhere anywhere / Windscribe client dns leak protection / ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere
windscribe_block all -- anywhere anywhere / Windscribe client rule */
Chain ufw-after-forward (1 references) target prot opt source destination
Chain ufw-after-input (1 references) target prot opt source destination
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references) target prot opt source destination
Chain ufw-after-logging-input (1 references) target prot opt source destination
Chain ufw-after-logging-output (1 references) target prot opt source destination
Chain ufw-after-output (1 references) target prot opt source destination
Chain ufw-before-forward (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ufw-user-forward all -- anywhere anywhere
Chain ufw-before-input (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-logging-deny all -- anywhere anywhere ctstate INVALID DROP all -- anywhere anywhere ctstate INVALID ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc ufw-not-local all -- anywhere anywhere
ACCEPT udp -- anywhere mdns.mcast.net udp dpt:mdns ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900 ufw-user-input all -- anywhere anywhere
Chain ufw-before-logging-forward (1 references) target prot opt source destination
Chain ufw-before-logging-input (1 references) target prot opt source destination
Chain ufw-before-logging-output (1 references) target prot opt source destination
Chain ufw-before-output (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-user-output all -- anywhere anywhere
Chain ufw-logging-allow (0 references) target prot opt source destination
Chain ufw-logging-deny (2 references) target prot opt source destination
Chain ufw-not-local (1 references) target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10 DROP all -- anywhere anywhere
Chain ufw-reject-forward (1 references) target prot opt source destination
Chain ufw-reject-input (1 references) target prot opt source destination
Chain ufw-reject-output (1 references) target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references) target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-input (7 references) target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-output (0 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-track-forward (1 references) target prot opt source destination
Chain ufw-track-input (1 references) target prot opt source destination
Chain ufw-track-output (1 references) target prot opt source destination
ACCEPT tcp -- anywhere anywhere ctstate NEW ACCEPT udp -- anywhere anywhere ctstate NEW
Chain ufw-user-forward (1 references) target prot opt source destination
Chain ufw-user-input (1 references) target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:22000 /* 'dapp_syncthing' / ACCEPT udp -- anywhere anywhere udp dpt:22000 / 'dapp_syncthing' / ACCEPT udp -- anywhere anywhere udp dpt:21027 / 'dapp_syncthing' */ ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:10387 ACCEPT udp -- anywhere anywhere udp dpt:10387
Chain ufw-user-limit (0 references) target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references) target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-user-logging-forward (0 references) target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw-user-logging-input (0 references) target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw-user-logging-output (0 references) target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw-user-output (1 references) target prot opt source destination
Chain windscribe_block (2 references) target prot opt source destination
DROP all -- anywhere anywhere /* Windscribe client rule */
Chain windscribe_dnsleaks (1 references) target prot opt source destination
DROP udp -- anywhere dns9.quad9.net udp dpt:domain /* Windscribe client dns leak protection / DROP tcp -- anywhere dns9.quad9.net tcp dpt:domain / Windscribe client dns leak protection */
Chain windscribe_input (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere /* Windscribe client rule / ACCEPT udp -- anywhere anywhere udp spts:bootps:bootpc dpts:bootps:bootpc / Windscribe client rule / ACCEPT all -- GTS anywhere / Windscribe client rule / DROP all -- 192.168.0.0/16 anywhere / Windscribe client rule / DROP all -- 172.16.0.0/12 anywhere / Windscribe client rule / DROP all -- 169.254.0.0/16 anywhere / Windscribe client rule / ACCEPT all -- 10.255.255.0/24 anywhere / Windscribe client rule / DROP all -- 10.0.0.0/8 anywhere / Windscribe client rule / DROP all -- base-address.mcast.net/4 anywhere / Windscribe client rule / ACCEPT all -- anywhere anywhere / Windscribe client rule / ACCEPT all -- 146.70.203.19 anywhere / Windscribe client rule / ACCEPT all -- localhost anywhere / Windscribe client rule / ACCEPT all -- localhost/8 anywhere / Windscribe client rule / ACCEPT all -- 192.168.0.0/16 anywhere / Windscribe client rule / ACCEPT all -- 172.16.0.0/12 anywhere / Windscribe client rule / ACCEPT all -- 169.254.0.0/16 anywhere / Windscribe client rule / DROP all -- 10.255.255.0/24 anywhere / Windscribe client rule / ACCEPT all -- 10.0.0.0/8 anywhere / Windscribe client rule / ACCEPT all -- base-address.mcast.net/4 anywhere / Windscribe client rule */
Chain windscribe_output (1 references) target prot opt source destination
ACCEPT all -- anywhere anywhere /* Windscribe client rule / ACCEPT udp -- anywhere anywhere udp spts:bootps:bootpc dpts:bootps:bootpc / Windscribe client rule / ACCEPT all -- anywhere GTS / Windscribe client rule / DROP all -- anywhere 192.168.0.0/16 / Windscribe client rule / DROP all -- anywhere 172.16.0.0/12 / Windscribe client rule / DROP all -- anywhere 169.254.0.0/16 / Windscribe client rule / ACCEPT all -- anywhere 10.255.255.0/24 / Windscribe client rule / DROP all -- anywhere 10.0.0.0/8 / Windscribe client rule / DROP all -- anywhere base-address.mcast.net/4 / Windscribe client rule / ACCEPT all -- anywhere anywhere / Windscribe client rule / ACCEPT all -- anywhere 146.70.203.19 owner GID match root / Windscribe client rule / ACCEPT all -- anywhere 146.70.203.19 owner GID match windscribe / Windscribe client rule / ACCEPT all -- anywhere 146.70.203.19 ! owner UID match 0-4294967294 / Windscribe client rule / ACCEPT all -- anywhere 146.70.203.19 mark match 0xca6c / Windscribe client rule / ACCEPT all -- anywhere localhost / Windscribe client rule / ACCEPT all -- anywhere localhost/8 / Windscribe client rule / ACCEPT all -- anywhere 192.168.0.0/16 / Windscribe client rule / ACCEPT all -- anywhere 172.16.0.0/12 / Windscribe client rule / ACCEPT all -- anywhere 169.254.0.0/16 / Windscribe client rule / DROP all -- anywhere 10.255.255.0/24 / Windscribe client rule / ACCEPT all -- anywhere 10.0.0.0/8 / Windscribe client rule / ACCEPT all -- anywhere base-address.mcast.net/4 / Windscribe client rule */