PSA: RackNerd ctrl Firewall is stateless and may block outbound UDP replies

VGL

A quick PSA for anyone using RackNerd's new ctrl Network Firewall.

I found that it can block replies to UDP connections initiated by the VPS.

My test was simple:

• UFW enabled and unchanged throughout.
• ctrl firewall enabled.
• Outbound DNS had packets going out and replies coming back.
• Another outbound UDP flow using a dynamic local source port had packets going out, but no replies reached the VPS.
• Explicitly allowing that temporary local port in ctrl, or disabling ctrl entirely, immediately restored the replies.

RackNerd escalated the ticket and checked with the ctrl developers. Their final explanation was:

• ctrl is intentionally a stateless inbound port filter.
• It does not generally track outbound-initiated UDP sessions.
• Replies to dynamic local UDP ports are dropped unless that port is explicitly allowed.
• DNS replies from TCP/UDP source port 53 are hardcoded exceptions.
• NTP replies from UDP source port 123 are also exceptions.
• For general stateful UDP, users should disable ctrl and use UFW/nftables/iptables instead.

So this is not a bug. It is an intentional limitation.

Stateless ACLs are perfectly valid, but I find the current naming and documentation misleading. "Network Firewall" sounds like the stateful cloud firewalls offered by most major providers, where matching replies to outbound connections are automatically allowed.

At minimum, the ctrl panel should clearly state:

"Stateless inbound port filter. General UDP return traffic is not automatically tracked. DNS and NTP replies are special exceptions."

Ideally, RackNerd could add an optional stateful mode. Otherwise, calling it a "Stateless Network ACL" would set much clearer expectations.

For now, if your VPS uses outbound UDP with dynamic local source ports:

• Disable the ctrl Network Firewall.
• Keep UFW/nftables/iptables enabled.
• Use default-deny inbound and allow established/related return traffic.

To RackNerd's credit, support checked with the developers, clearly confirmed the behavior, and agreed that the documentation should be improved.

@dustinc, any chance ctrl could eventually support optional stateful connection tracking, or at least show a prominent stateless warning before users enable the firewall?

fredo1664

Jeez the title read like deepseek infused MJJ drama, the wall of text looked like MJJ drama, but this was actually informative and interesting. Refreshing!