0

I'm a little lost and hope someone can point me into the right direction to solve my problem. I have a server running with a Debian distribution and I'm using UFW as firewall. The configuration and setup was pretty easy and I started the firewall as documented with:

manly@server:~$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

If I check, if ufw is running I receive (correctly):

manly@server:~$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
22                         ALLOW       Anywhere (v6)
80/tcp                     ALLOW       Anywhere (v6)

After some time (I check daily), the firewall turns inactive - even without any restart in between -, i.e., status returns inactive:

manly@server:~$ sudo ufw status
Status: inactive

I have no idea why. What can I check to figure out the reasons behind that weird behavior. I'm thankful for any advice!

Update:

I noticed something, which may help to find a solution. So I start the ufw with the sudo ufw enable in an ssh session. It seems like, that if I keep the ssh session open, the firewall is enabled. If I close the ssh session (exit), the ufw status will be set to inactive after some time. Do I have to start the ufw in any special manner?

migrated from stackoverflow.com Aug 9 '16 at 11:53

This question came from our site for professional and enthusiast programmers.

  • System logs and shell histories... serverfault.com/questions/516838/… – user356540 Aug 4 '16 at 5:03
  • @user356540 I checked the logs and the shell history. The logs just includes blocked requests like: Aug 3 00:49:34 server kernel: [266192.716803] [UFW BLOCK] IN=... OUT= MAC=... SRC=... DST=... LEN=46 TOS=0x00 PREC=0x00 TTL=47 ID=5813 PROTO=UDP SPT=38793 DPT=53413 LEN=26 – Philipp Aug 4 '16 at 6:19
  • I meant the firewall process log as opposed to the packet filtering log. Sorry for not being more specific. – user356540 Aug 8 '16 at 21:44
1

Edit your configuration file /etc/ufw/ufw.conf as root and set ENABLED=yes:

# /etc/ufw/ufw.conf
#

# Set to yes to start on boot. If setting this remotely, be sure to add a rule
# to allow your remote connection before starting ufw. Eg: 'ufw allow 22/tcp'
ENABLED=yes

# Please use the 'ufw' command to set the loglevel. Eg: 'ufw logging medium'.
# See 'man ufw' for details.
LOGLEVEL=low
  • Thanks for the suggestion. The file already has the enabled set to yes. I added some further information to the case, which may help to find a solution (ssh session?) – Philipp Aug 8 '16 at 16:42
0

So after some digging and talking to the support, we finally figured out, what stops UFW. The system also had APF (Advanced Policy Firewall - R-fx Networks) configured, which adds a cron-job to the system. The job removes all rules on midnight and resets the rules defined for APF.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.