Member Avatar for McLaren

Hello,

I was experimenting with firewall configuration. As I understand there are iptables - there is saved configuration. But as additional tool - ufw can be installed for simpler configuration. I installed it and experimented. Btw I checked

sudo iptables --list

and there was some lines like

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ufw-before-logging-output  all  --  anywhere             anywhere

but I did not touch them. Maybe ufw changes them. Not sure.

I played around with uwf - adding some rules, removing them. ANd then I disabled uwf. WHen I done this - the old configuration is still filtering which was in iptables, right?

I don't want to leave without firewall :D

  • 2 Contributors
  • 2 Replies
  • 242 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by McLaren

Dani AI

Generated

Short answer: UFW is just a front end that writes iptables/netfilter rules. Disabling UFW stops that front end and (in normal operation) removes the chains and rules it manages, but the iptables/netfilter subsystem in the kernel remains present — and any rules not created by UFW (or persistent rules restored at boot) will still be active. This explains why saw ufw-related chains in the listing but was unsure what would happen after ufw disable. Ubuntu UFW docs and the iptables manual explain this relationship. (wiki.ubuntu.com)

Practical checks to make sure you’re not left unprotected: confirm UFW’s state, inspect the current kernel rule set, and check UFW’s rule files. For example:

sudo ufw status verbose
sudo systemctl status ufw
sudo iptables-save
ls -l /etc/ufw /var/lib/ufw

Look in the iptables-save output for non-UFW chains (Docker, libvirt, etc.) that other services create — those won’t be removed by disabling UFW. The UFW docs and Docker/networking docs cover these interactions. ()

Why you might still see “leftovers”: UFW uses user-defined chains and several scriptable rule files; its stop/disable behavior can leave chains depending on configuration (MANAGE_BUILTINS, persistent restore tools) or if other services added references. Uninstalling UFW won’t magically delete all kernel rules — persistent rule loaders or other daemons can re-create them. See the UFW framework notes and community Q&A for examples. (mankier.com)

If you want guaranteed filtering: either re-enable/configure UFW (allow SSH first) or manage iptables/nftables directly and save rules with a persistent tool (iptables-persistent / netfilter-persistent). If you’re unsure which chains are doing the filtering, inspect iptables-save and only change what you can safely restore (and avoid flushing rules remotely without a recovery plan). ()

Note: ’s suspicion about leftovers is valid — it’s common to see UFW chains or other tool chains linger until you explicitly reset/purge them or remove whatever is restoring rules at boot.

Member Avatar for metalized

is this the only output you get with "iptables --list"?

I have not played arround with ufw but, this seems that there are some leftover from it, even after disabling it.

which distro are you using?

Member Avatar for McLaren

is this the only output you get with "iptables --list"?

As I remember there were more lines, I just did not want to copy all of them in the forum. These were as example.

which distro are you using?

ubuntu

Edited by McLaren
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.