Why does UFW use a different sysctl.conf file?

Question

There are a lot of network-related settings in /etc/sysctl.conf and a number of files in /etc/sysctl.d/. My data centre operator who has preconfigured the Ubuntu OS to work best in their environment has also added a custom file in there. I guess they come in a good state with the OS and I only need to make changes there if I have good reasons to do so. I don't fully understand all the details about the security issues they may cover so I'd rather not touch them.

When I enable the firewall UFW (uncomplicated firewall), its config file says it will override these settings with its own copy in /etc/ufw/sysctl.conf.

I have two questions regarding to that:

1. Does this mean that all existing settings in the /etc/sysctl.conf file and /etc/sysctl.d/* files are completely ignored and only /etc/ufw/sysctl.conf is ever regarded? Or will anything mentioned in /etc/ufw/sysctl.conf just override the other existing settings (and nothing will happen if I comment away or delete all of its lines)?

2. Why is a separate file used at all? The old files are still in place but possibly/partially unused or ineffective. That seems like very bad practice and a big source of errors and confusion. It is documented how I could stop this behaviour and switch back to the default file (it's unclear though what then happens to /etc/sysctl.d/*). Why should I not do this? And why is this not the default already?

I couldn't find any information about these topics online. There are many places that explain that there are separate files with UFW and I should edit them instead. But noone explains why. I cannot make decisions without knowing the effects.

Answer 1

Here's a partial answer about what I found out so far.

Reading the source code of UFW, I found it just loads in the settings from its own config file when UFW starts. This means that at this point, it will add all settings from that file to the already existing configuration. This will override just the values that are active in this file and will leave all other settings untouched. If this file is made empty, it will do nothing.

I also checked each key in that file and found out that there are no overlaps for Ubuntu 18.04. Most settings are new (not included in the existing system files), only one or two will set the same key but also to the same value, so it won't change anything.

Based on this, I decided to leave things as they are. Should I ever have to adjust something, I'll have to remember to check three locations:

• /etc/sysctl.conf
• /etc/sysctl.d/*
• /etc/ufw/sysctl.conf

I still have no answer to the reasons behind this design yet. IMO, UFW should just have added their file in the /etc/sysctl.d directory.

It also looks like (in the code) that UFW will never write to this file, so it's just one additional config file that's loaded and that the admin has to maintain. It appears not to be separated because UFW would want to write to it.