netcup Firewall configuration

Just enabled the new netcup firewall and see weird behavior for this very simple use case: Allow wireguard in only, allow all outgoing.

The docs confused me with these two sections:

1) "To whitelist UDP traffic, you must create INGRESS and EGRESS rules in your policy"
2) "We recommend creating INGRESS rules only."

As far as I understand defining no EGRESS rules means all EGRESS traffic is allowed by default (via implicit rule). Anyhow defining the following rule

INGRESS, UDP, allow, Port 51820

allows to establish the wireguard connection. But outgoing udp traffic seems to be blocked although the **implicit rule** at the very bottom reads like this:

EGRESS, all, allow

What breaks is outgoing dns traffic (udp, port 53). Ok so maybe the first section (see above, whitelisting udp traffic means you must create an egress rule) applies, so I explicitly added:

EGRESS, udp, allow
EGRESS, tcp, allow

And still outgoing udp traffic on port 53 is not allowed. Which kind of makes sense when the GUI is precise about: "Rules are applied from top to bottom", because creating egress rules will lead to the implicit rule of denying egress traffic for all protocols/ports/networks.

The question is: How can I realise my use case then?

Thanks heaps!

Ok, I think I got the issue now. TCP is stateful and can be tracked, thus TCP responses for outgoing TCP requests are accepted (established connections). BUT UDP responses need to be explicitly allowed?

Thanks for your answer!

Sorry but this topic is still open on my end xD From what I got (see above) this configuration should work. Unfortunately dns responses are still timing out. Any hints? Much appreciated!

pasted-from-clipboard.png

Question (@netcup-team): Strictly reading this view from top to bottom considering the note at the very top ("Rules are applied from top to bottom"): Shouldn't implicit rules rather be displayed at the very top?

Zitat

Allow UDP from source port 53

My bad, thanks a lot!