0

I'm a little lost and hope someone can point me into the right direction to solve my problem. I have a server running with a Debian distribution and I'm using UFW as firewall. The configuration and setup was pretty easy and I started the firewall as documented with:

manly@server:~$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

If I check, if ufw is running I receive (correctly):

manly@server:~$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
22                         ALLOW       Anywhere (v6)
80/tcp                     ALLOW       Anywhere (v6)

After some time (I check daily), the firewall turns inactive - even without any restart in between -, i.e., status returns inactive:

manly@server:~$ sudo ufw status
Status: inactive

I have no idea why. What can I check to figure out the reasons behind that weird behavior. I'm thankful for any advice!

Update:

I noticed something, which may help to find a solution. So I start the ufw with the sudo ufw enable in an ssh session. It seems like, that if I keep the ssh session open, the firewall is enabled. If I close the ssh session (exit), the ufw status will be set to inactive after some time. Do I have to start the ufw in any special manner?

Improve this question
3
  • System logs and shell histories... serverfault.com/questions/516838/…
    – Neil Davis
    Commented Aug 4, 2016 at 5:03
  • @user356540 I checked the logs and the shell history. The logs just includes blocked requests like: Aug 3 00:49:34 server kernel: [266192.716803] [UFW BLOCK] IN=... OUT= MAC=... SRC=... DST=... LEN=46 TOS=0x00 PREC=0x00 TTL=47 ID=5813 PROTO=UDP SPT=38793 DPT=53413 LEN=26
    – Philipp
    Commented Aug 4, 2016 at 6:19
  • I meant the firewall process log as opposed to the packet filtering log. Sorry for not being more specific.
    – Neil Davis
    Commented Aug 8, 2016 at 21:44

2 Answers 2

Reset to default
1

Edit your configuration file /etc/ufw/ufw.conf as root and set ENABLED=yes:

# /etc/ufw/ufw.conf
#

# Set to yes to start on boot. If setting this remotely, be sure to add a rule
# to allow your remote connection before starting ufw. Eg: 'ufw allow 22/tcp'
ENABLED=yes

# Please use the 'ufw' command to set the loglevel. Eg: 'ufw logging medium'.
# See 'man ufw' for details.
LOGLEVEL=low
Improve this answer
1
  • Thanks for the suggestion. The file already has the enabled set to yes. I added some further information to the case, which may help to find a solution (ssh session?)
    – Philipp
    Commented Aug 8, 2016 at 16:42
0

So after some digging and talking to the support, we finally figured out, what stops UFW. The system also had APF (Advanced Policy Firewall - R-fx Networks) configured, which adds a cron-job to the system. The job removes all rules on midnight and resets the rules defined for APF.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .