Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

UFW is working really well for me except in the cases where it doesn't...

I want to be able to add another rule manually that will be applied on boot?

  • where should i put this rule?
  • how should I make it start at boot?
  • how do I make it play nicely with UFW?
share|improve this question
ufw is one of those "what you see is all you get" things that make it easier for newbies. If you need to do more than it can do, consider switching to iptables completely. That "working really well for me" is a good proof that you can try something (iptables) more complicated (but also more flexible). – halp Nov 5 '10 at 5:02

1 Answer

up vote 2 down vote accepted

According to this Ubuntu wiki page (scroll down to "Advanced Functionality"), you can achieve what you want by putting your own iptables rules into the following files:

  • /etc/ufw/before.rules
  • /etc/ufw/after.rules

The before file is evaluated before any ufw rules are applied; the after file is evaluated after. (There are also corresponding before6 and after6 rules files, for your ip6tables rules.)

These rules files are expected to be in iptables-restore-compatible syntax, presumably because ufw simply loads them using iptables-restore. Finally, note that you need to stop and restart ufw after you make any changes to the rules files.

share|improve this answer
1  
Note that you can (perhaps unintentionally) change the precedence of iptables rules if you forget to standardize the use of -I or -A when using these files. -I (insert) adds rules to the TOP of the chain, evaluated first, while the -A (append) adds them to the bottom of the chain. This might cause unexpected results if you use -I in the .after file, for example. Just a thought. – Sam Halicke Nov 5 '10 at 4:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.