Replies: 1 comment 13 replies
-
|
hi @mbnoimi , mm, everything seems to be correct. Could you post some connections generated by kdeconnect? -> Tab Applications -> double click on kdeconnect -> select a range of rows -> CTRL+C I'll try to reproduce it |
Beta Was this translation helpful? Give feedback.
13 replies
-
I don't use UFW anymore (it's already deactivated)
|
Beta Was this translation helpful? Give feedback.
-
|
Everything looks fine to me. There's no rule to exclude connections on the mangle-output chain, so that's fine. Next steps:
Open kdeconnect settings from the systray and see if there're connections to 255.255.255.255:1716, for example: ~ # tcpdump -v port 1716
tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
16:16:28.607573 IP (tos 0x0, ttl 64, id 11732, offset 0, flags [+], proto UDP (17), length 1500) |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
:( I don't know why you don't have a single connection of kdeconnect intercepted. Anyway, back to the root of the problem: I'm wondering if the reason could be due to this entry in the filter-input chain -> Unless you compile latest sources from the master branch, for now set default input policy to Allow, and use ufw to configure input policy and inbound fw rules. |
Beta Was this translation helpful? Give feedback.
-
|
When you open kdeconnect settings to pair a new device (systray -> status and notifications -> kdeconnect -> pair a device), clicking on Refresh generates a new outbound connection: If you open kdeconnect on the mobile and click on Refresh, it sends connections attempts to the system where opensnitch is running. These are inbound connections, and what we see in the logs are responses from the system to the mobile device: i.e.: every connection that appears in /var/log/opensnitchd.log (log level -> debug) or in the Events tab, is an outbound connection, from the system to the world. I'll keep analyzing it because even with opensnitch/nftables completely disabled, now the devices are not pairing. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hi,
I set system rules setting to DENY inbound as shown below. After applying this rule I no longer able to connect my PC with my phone using KDE Connect!
1. How can I enable KDE Connect connections?
KDE Connect works fine with UFW configurations because I was set UFW to accept all local connections using
ufw allow from 192.168.1.0/242. Can I allow all LAN inbound using OpenSnitch just like UFW?
Some info
{ "Table": "", "Chain": "", "UUID": "f30ebbb6-060f-11ed-8fb4-2b1e3b3c558e", "Enabled": true, "Position": "0", "Description": "KDE Connect", "Parameters": "", "Expressions": [ { "Statement": { "Op": "==", "Name": "tcp", "Values": [ { "Key": "dport", "Value": "1714-1764" } ] } } ], "Target": "accept", "TargetParameters": "" }kdeconnectd.json
{ "created": "2022-07-19T08:08:37.154482959+03:00", "updated": "2022-07-19T08:08:37.154875816+03:00", "name": "kdeconnectd", "description": "", "enabled": true, "precedence": true, "nolog": false, "action": "allow", "duration": "always", "operator": { "type": "list", "operand": "list", "sensitive": false, "data": "[{\"type\": \"simple\", \"operand\": \"process.path\", \"data\": \"/usr/lib/x86_64-linux-gnu/libexec/kdeconnectd\", \"sensitive\": false}, {\"type\": \"regexp\", \"operand\": \"dest.ip\", \"data\": \"^(127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.1[6-9]\\\\.\\\\d+\\\\.\\\\d+|172\\\\.2[0-9]\\\\.\\\\d+\\\\.\\\\d+|172\\\\.3[0-1]+\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|::1|f[cde].*::.*)$\", \"sensitive\": false}]", "list": [ { "type": "simple", "operand": "process.path", "sensitive": false, "data": "/usr/lib/x86_64-linux-gnu/libexec/kdeconnectd", "list": null }, { "type": "regexp", "operand": "dest.ip", "sensitive": false, "data": "^(127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|169\\.254\\.\\d{1,3}\\.\\d{1,3}|192\\.168\\.\\d{1,3}\\.\\d{1,3}|172\\.1[6-9]\\.\\d+\\.\\d+|172\\.2[0-9]\\.\\d+\\.\\d+|172\\.3[0-1]+\\.\\d{1,3}\\.\\d{1,3}|10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|::1|f[cde].*::.*)$", "list": null } ] } }kdeconnect-indicator.json
{ "created": "2022-07-19T08:08:26.393680065+03:00", "updated": "2022-07-19T08:08:26.394146842+03:00", "name": "kdeconnect-indicator", "description": "", "enabled": true, "precedence": true, "nolog": false, "action": "allow", "duration": "always", "operator": { "type": "list", "operand": "list", "sensitive": false, "data": "[{\"type\": \"simple\", \"operand\": \"process.path\", \"data\": \"/usr/bin/kdeconnect-indicator\", \"sensitive\": false}, {\"type\": \"regexp\", \"operand\": \"dest.ip\", \"data\": \"^(127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.1[6-9]\\\\.\\\\d+\\\\.\\\\d+|172\\\\.2[0-9]\\\\.\\\\d+\\\\.\\\\d+|172\\\\.3[0-1]+\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|::1|f[cde].*::.*)$\", \"sensitive\": false}]", "list": [ { "type": "simple", "operand": "process.path", "sensitive": false, "data": "/usr/bin/kdeconnect-indicator", "list": null }, { "type": "regexp", "operand": "dest.ip", "sensitive": false, "data": "^(127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|169\\.254\\.\\d{1,3}\\.\\d{1,3}|192\\.168\\.\\d{1,3}\\.\\d{1,3}|172\\.1[6-9]\\.\\d+\\.\\d+|172\\.2[0-9]\\.\\d+\\.\\d+|172\\.3[0-1]+\\.\\d{1,3}\\.\\d{1,3}|10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|::1|f[cde].*::.*)$", "list": null } ] } }Beta Was this translation helpful? Give feedback.
All reactions