Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
VDS.net
InterServer VPS
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
MeduzaVPN
Servury - Anonymous & Privacy-focused VPS Hosting
Animated Silicon Kiwi cloud ad featuring VPS from $4.90/month, 100 GB S3 storage from $1.49/month, Kiwi Apps from $12/month and cloud backup from $3/month
Lium GPU Pods

Categories

In this Discussion

Home › General
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

PSA: RackNerd ctrl Firewall is stateless and may block outbound UDP replies

VGLVGL Member
in General

A quick PSA for anyone using RackNerd's new ctrl Network Firewall.

I found that it can block replies to UDP connections initiated by the VPS.

My test was simple:

  • UFW enabled and unchanged throughout.
  • ctrl firewall enabled.
  • Outbound DNS had packets going out and replies coming back.
  • Another outbound UDP flow using a dynamic local source port had packets going out, but no replies reached the VPS.
  • Explicitly allowing that temporary local port in ctrl, or disabling ctrl entirely, immediately restored the replies.

RackNerd escalated the ticket and checked with the ctrl developers. Their final explanation was:

  • ctrl is intentionally a stateless inbound port filter.
  • It does not generally track outbound-initiated UDP sessions.
  • Replies to dynamic local UDP ports are dropped unless that port is explicitly allowed.
  • DNS replies from TCP/UDP source port 53 are hardcoded exceptions.
  • NTP replies from UDP source port 123 are also exceptions.
  • For general stateful UDP, users should disable ctrl and use UFW/nftables/iptables instead.

So this is not a bug. It is an intentional limitation.

Stateless ACLs are perfectly valid, but I find the current naming and documentation misleading. "Network Firewall" sounds like the stateful cloud firewalls offered by most major providers, where matching replies to outbound connections are automatically allowed.

At minimum, the ctrl panel should clearly state:

"Stateless inbound port filter. General UDP return traffic is not automatically tracked. DNS and NTP replies are special exceptions."

Ideally, RackNerd could add an optional stateful mode. Otherwise, calling it a "Stateless Network ACL" would set much clearer expectations.

For now, if your VPS uses outbound UDP with dynamic local source ports:

  • Disable the ctrl Network Firewall.
  • Keep UFW/nftables/iptables enabled.
  • Use default-deny inbound and allow established/related return traffic.

To RackNerd's credit, support checked with the developers, clearly confirmed the behavior, and agreed that the documentation should be improved.

@dustinc, any chance ctrl could eventually support optional stateful connection tracking, or at least show a prominent stateless warning before users enable the firewall?

Thanked by 2zed dustinc
What should RackNerd do with the ctrl Network Firewall?
  1. Add optional stateful TCP/UDP connection tracking5 votes
    1. Keep it stateless, but rename it to “Network ACL”
        0.00%
    2. Keep the current name, but clearly document the limitation and DNS/NTP exceptions
        0.00%
    3. Offer both stateless and stateful modes
      20.00%
    4. No change needed, just use the OS firewall
      20.00%
    5. I don't use the ctrl firewall / just here for the popcorn 🍿
      60.00%

Comments

  • fredo1664fredo1664 Member

    Jeez the title read like deepseek infused MJJ drama, the wall of text looked like MJJ drama, but this was actually informative and interesting. Refreshing!

  • dustincdustinc Patron Provider, Top Host, Veteran

    Hi @VGL, Thank You for the feedback! Glad our support team was able to clarify this for you. As mentioned, the ctrl Network Firewall is optional and disabled by default. Feedback has been quite positive, with customers appreciating the additional layer of protection, and we’ll continue improving it and adding additional capabilities.

    Since launching last month, ctrl has been very well received by our customers and the community, which we’re happy to see. We appreciate feedback like this by the way! Because ctrl is our own proprietary software and we are no longer tied to the decisions or roadmap of a third party software vendor, we’re continuing to build on ctrl, and making sure the existing features are clearly understood is part of that effort too 👊

  • dustincdustinc Patron Provider, Top Host, Veteran

    @fredo1664 said:
    Jeez the title read like deepseek infused MJJ drama, the wall of text looked like MJJ drama, but this was actually informative and interesting. Refreshing!

    Hi @fredo1664 -- Yep! @VGL has been around LET long enough, and has contributed some great feedback/activity on the AdminBolt thread too: https://lowendtalk.com/discussion/221872/giveaway-by-adminbolt-racknerd-100x-free-vps-for-a-year-20x-lifetime-licenses-lets-talk/

    We appreciate him taking the time to share his experience here as well. I'd say he's part of the #RackNerdGang -- let's goooo!

Sign In or Register to comment.