Configure UFW for RaspAP

[monkeycode1]

Running Raspbian Bullseye

Would like to know how to configure UFW to allow wifi hotspot to be allowed through the firewall.

With default UFW settings, I cannot access the wifi hotspot.

[billz]

UFW's default policy is to deny all incoming connections but allow all outgoing connections:

 $ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

For your AP to work, you will need to allow incoming connections for dnsmasq and dhcp queries:

sudo ufw allow in on wlan0 from any port 68 to any port 67 proto udp
sudo ufw allow in on wlan0 from 10.3.141.1/24 to any port 53

You'll probably also want to permit incoming ssh connections on the wireless interface:

sudo ufw allow in on wlan0 from 10.3.141.1/24 to any port 22 proto tcp

Using the above as examples, add a rule to allow incoming connections on port 80 (lighttpd) so you can access RaspAP's web UI.

These are just the basics to help get you started. How you choose to configure your firewall depends on your existing network setup and your specific goals. There are many tutorials online to take you further.

RaspAP Insiders has an optional firewall component that uses iptables.
It's preconfigured for the AP and many additional services (OpenVPN, WireGuard, etc.)
https://docs.raspap.com/firewall/

[monkeycode1]

I just tried your suggestions, they worked perfectly for what I was trying to achieve.

I just did another fresh install of Raspbian Bullseye and installed RaspAP and UFW.

The only rules I used are the ones below. These gave me access to the WiFi hotspot, however connected without internet.

sudo ufw allow in on wlan0 from any port 68 to any port 67 proto udp
sudo ufw allow in on wlan0 from 10.3.141.1/24 to any port 53

In order to allow internet connectivity on the WiFi hotspot, I just added the following rule to UFW to route traffic from wlan0 to eth0.

sudo ufw route allow in on wlan0 out eth0

This works perfect now, thank you again for your help! :)

[monkeycode1]

Thank you so much for your easy to understand instructions. I will test these out later and see how it goes :)

[monkeycode1]

I would like to request some assistance with creating a VPN killswitch when using the OpenVPN feature on RaspAP, however I will create another topic for that one :)