AusweisApp’s “Smartphone als Kartenleser” (SaK) pairing on Linux can fail silently: the phone never shows up, no error, no log. If UFW is on, the most likely cause is that the phone’s UDP discovery broadcast on port 24727 is being dropped before it ever reaches the app. One firewall rule fixes it.

Step 1: Install AusweisApp

AusweisApp used to live in the AUR, but has since moved into the official extra repository (archlinux.org) (this post originally recommended paru -S ausweisapp):

sudo pacman -S ausweisapp

Launch the app once after install, it needs to be running for the pairing to work.

Step 2: Find your interface and broadcast address

ip -4 -br addr

You’ll get something like:

wlan0            UP             192.168.0.50/24

You need three values for the UFW rule:

  • Your interface name (wlan0 here)
  • Your subnet (192.168.0.0/24)
  • The broadcast address for that subnet. For a /24 it’s the same first three octets with .255 at the end (192.168.0.255). For a /16 it’s 192.168.255.255.

Step 3: Allow the broadcast

sudo ufw allow in on wlan0 from 192.168.0.0/24 to 192.168.0.255 port 24727 proto udp comment 'AusweisApp Broadcast'
sudo ufw reload

Substitute your own interface, subnet, and broadcast from Step 2. Now start the SaK pairing on the phone — AusweisApp should pick it up within a second or two.

Why UFW blocks it by default

UFW’s incoming policy is default-deny, and a blanket ufw allow … to any port 24727 rule doesn’t cover this traffic in practice: the phone’s discovery packets are addressed to the subnet broadcast (192.168.X.255 for a /24, 192.168.255.255 for a /16), and they still get dropped. The allow in on <iface> … to <broadcast> form names that destination explicitly, which is what gets the packets through to AusweisApp’s UDP socket. Same trap can hit any LAN service that uses subnet-directed broadcast for discovery.

Verifying

If pairing still doesn’t work, two commands narrow it down. First, make sure AusweisApp is actually listening:

ss -tulpn 2>/dev/null | grep 24727

You should see a udp UNCONN line on port 24727 owned by AusweisApp. Then check whether the phone’s broadcasts are reaching your NIC at all:

sudo tcpdump -i wlan0 -n 'udp port 24727' -vv

Start the pairing on the phone. If tcpdump shows packets but pairing still fails, the firewall is the problem — go back to Step 3. If tcpdump shows nothing, the issue is upstream of your machine (Wi-Fi isolation, AP client isolation, guest network, phone on a different SSID).

That split is the general pattern: tcpdump upstream of the socket separates network problems from local ones.