I rent a remote machine with Debian/Ubuntu and desire to filter all ports I don't use through iptables via ufw.

The only ports I allow (both with TCP and UPD) are 22,25,80,443.

If I understand man ufw correctly ufw usually uses for interactive-usage and if we want to use it non-interactively we must "force" such usage. Hence:

  1. In Bash script, the syntax ufw --force enables it for non interactive usage.
  2. By adding enable right afterwards (as to get ufw --force enable) we both reset the firewall and also make ufw to recursively being booted after the OS boots.

Is that correct?


Yes, you are correct. Have a look at the man page of ufw using man ufw. Under REMOTE MANAGEMENT they say:

When running ufw enable or starting ufw via its initscript, ufw will flush its chains. This is required so ufw can maintain a consistent state, but it may drop existing connections (eg ssh). ufw does support adding rules before enabling the firewall, so administrators can do:

ufw allow proto tcp from any to any port 22

before running 'ufw enable'. The rules will still be flushed, but the ssh port will be open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not flush the chains when adding or removing rules (but will when modifying a rule or changing the default policy). By default, ufw will prompt when enabling the firewall while running under ssh. This can be disabled by using 'ufw --force enable'.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy