UFW is working really well for me except in the cases where it doesn't...

I want to be able to add another rule manually that will be applied on boot?

  • where should i put this rule?
  • how should I make it start at boot?
  • how do I make it play nicely with UFW?
  • 1
    ufw is one of those "what you see is all you get" things that make it easier for newbies. If you need to do more than it can do, consider switching to iptables completely. That "working really well for me" is a good proof that you can try something (iptables) more complicated (but also more flexible). – halp Nov 5 '10 at 5:02

According to this Ubuntu wiki page (scroll down to "Advanced Functionality"), you can achieve what you want by putting your own iptables rules into the following files:

  • /etc/ufw/before.rules
  • /etc/ufw/after.rules

The before file is evaluated before any ufw rules are applied; the after file is evaluated after. (There are also corresponding before6 and after6 rules files, for your ip6tables rules.)

These rules files are expected to be in iptables-restore-compatible syntax, presumably because ufw simply loads them using iptables-restore. Finally, note that you need to stop and restart ufw after you make any changes to the rules files.

| improve this answer | |
  • 4
    Note that you can (perhaps unintentionally) change the precedence of iptables rules if you forget to standardize the use of -I or -A when using these files. -I (insert) adds rules to the TOP of the chain, evaluated first, while the -A (append) adds them to the bottom of the chain. This might cause unexpected results if you use -I in the .after file, for example. Just a thought. – Sam Halicke Nov 5 '10 at 4:11
  • Does the order of the rules matters? How do I know if I want my rule before or after UFW? – Freedo Mar 28 at 5:44

UFW will purge any MANUALLY added rule in /etc/ufw/user.rules which is NOT prefaced with a comment:

### tuple ### allow tcp 80 any out
-A ufw-user-output -p tcp --dport 80 -j ACCEPT

When UFW sanity checks the rules on startup, it expects an accompanying comment. If it's NOT present, even if the syntax of the rule is correct, UFW will still purge it.

And don't just use any arbitrary comment: it MUST be the comment that UFW would insert when creating a user rule via the cli, ie:

sudo ufw allow http/tcp

So if you want to pre-seed a series of rules in a ruleset in a simple file, you'd still need to create the rules via UFW's CLI interface to learn the syntax of the comments it expects for the rule to pass validation and persist.

Try the foregoing with and WITHOUT the comment and reload the specimen HTTP rule above; you'll remark only with the comment does the manually added rule survive a restart (ufw enable) of UFW.

This is really counter-intuitive behaviour and not documented at all.

| improve this answer | |
  • Great explanation! It's a bit puzzling for me why this core behavior is not clarified clearly on most of the docs I've seen – weshouman Nov 6 at 6:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.