Is it really necessary to run UFW behind my Gateway Router which already has Firewall/Port rules?

In this example, I am discussing running UFW on an Internet Accessible (Linux) Server that is behind a Natted Firewall Gateway Router.

Please be specific, don't just say yes because there are hackers out there! (Though that is valid answer)

Is it just for internal protection? If so, I know I can trust my LAN, can I not run UFW?

  • If you already have a firewall that offers all the protection you require and you trust your LAN, then you don't need an additional one to protect the host. But we don't know your setup, requirements, services you a running, etc. So it's hard to provide a clear answer.
    – Marco
    Dec 3, 2015 at 11:51

2 Answers 2


Ultimately this is a security question more than a unix/linux question.

Technically the answer is no, it is not necessary to run it for things to work right (depending on what else you're running).

I don't run host firewalls on my network at home because I have my modem/router/accesspoint set up such that there are no inbound connections allowed, and like you I 'trust' my home lan.

However, this is my home lan. I have very little interesting data on it and nothing to attract hackers, and mostly the sort of defenses that keep out drivebys.

The next threat then is malicious code delivered via your web browser. This really means that you can't trust your home network. In this scenario someone hijacks a web server (cross sight scripting, whatever) and you wind up with some sort of bot on your machine that then scans your network and replicates. There was a government facility with a classified "Secret" network (meaning the data on it was classified secret, not the network itself) that had an infestation that they were having serious trouble getting rid of because whatever was on their machines was spreading as fast as they could reimage machines. This, however, was almost all Windows machines on Active Directory with the mono-culture and security problems that implies[1].

Maybe it's a problem for you, maybe it isn't. That's your evaluation to make.

Ultimately on a home network with very little to no inbound ports open, minimal network services running and otherwise good security practices host based firewalls aren't going provide a significant gain in security.

However, in a business with any sort of PII then you go that extra mile.

THAT SAID. We all should probably be running host based firewalls. We should know what network activity the computer is initiating on our behalf and taking care of it.

But busy and distrac...


In addition to what Petro said, I think it depends on what rules you'd run in UFW. The way I look at it is that I don't fully trust any workstation inside the LAN. A workstation can contract a backdoor virus that allows a hacker to attack your network from the inside out. So, having a FW up to possibly block a compromised workstation from attacking your server, may be worth the effort. On the other hand, if you're going to implement a rule allowing, say, ssh from any LAN device, then the benefits of the UFW diminish.

My UTM at home supports easy implementation of VLANs, which allows the UTM to inspect and firewall traffic between subnets. This allows me to put devices in various levels of trust. Web based servers in the lowest level of trust (effectively a DMZ), KVM host in a separate VLAN as the highest level of trust, backup server on a private vlan and end-user devices in a 4th vlan. Overkill for home, but it was a setup I was testing for work and left it in place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .