UFW 
FRAMEWORK(8)						    August 2009 						  UFW FRAMEWORK(8)

NAME

       ufw-framework - using the ufw framework

DESCRIPTION

       ufw provides both a command line interface and a framework for managing a netfilter firewall. While the ufw command provides an easy to use
       interface for managing a firewall, the ufw framework provides the administrator methods to customize default behavior  and  add	rules  not
       supported by the command line tool. In this way, ufw can take full advantage of Linux netfilter's power and flexibility.

OVERVIEW

       The framework provides boot time initialization, rules files for adding custom rules, a method for loading netfilter modules, configuration
       of kernel parameters and configuration of IPv6. The framework consists of the following files:

       /lib/ufw/ufw-init
	      initialization script

       /etc/ufw/before[6].rules
	      rules file containing rules evaluated before UI added rules

       /lib/ufw/user[6].rules
	      rules file containing UI added rules (managed with the ufw command)

       /etc/ufw/after[6].rules
	      rules file containing rules evaluated after UI added rules

       /etc/default/ufw
	      high level configuration

       /etc/ufw/sysctl.conf
	      kernel network tunables

       /etc/ufw/ufw.conf
	      additional high level configuration

BOOT INITIALIZATION

       ufw is started on boot with /lib/ufw/ufw-init. This script is a standard SysV style initscript used by the ufw command and  should  not	be
       modified. It supports the following arguments:

       start: loads the firewall

       stop:  unloads the firewall

       restart:
	      reloads the firewall

       force-reload:
	      same as restart

       status:
	      basic status of the firewall

       force-stop:
	      same as stop, except does not check if the firewall is already loaded

       flush-all:
	      flushes the built-in chains, deletes all non-built-in chains and resets the policy to ACCEPT

       ufw  uses  many user-defined chains in addition to the built-in iptables chains. If MANAGE_BUILTINS in /etc/default/ufw is set to 'yes', on
       stop and reload the built-in chains are flushed. If it is set to 'no', on stop and reload the ufw secondary chains are removed and the  ufw
       primary	chains are flushed. In addition to flushing the ufw specific chains, it keeps the primary chains in the same order with respect to
       any other user-defined chains that may have been added. This allows for ufw to interoperate with other software that may manage	their  own
       firewall rules.

       To ensure your firewall is loading on boot, you must integrate this script into the boot process. Consult your distribution's documentation
       for the proper way to modify your boot process if ufw is not already integrated.

RULES FILES

       ufw  is	in  part  a  front-end	for  iptables-restore,	with  its  rules  saved   in   /etc/ufw/before.rules,	/etc/ufw/after.rules   and
       /lib/ufw/user.rules.  Administrators  can  customize  before.rules  and	after.rules as desired using the standard iptables-restore syntax.
       Rules are evaluated as follows: before.rules first, user.rules next, and after.rules last. IPv6 rules are evaluated in the same	way,  with
       the  rules files named before6.rules, user6.rules and after6.rules. Please note that ufw status only shows rules added with ufw and not the
       rules found in the /etc/ufw rules files.

       Important: ufw only uses the *filter table by default. You may add any other tables such as *nat, *raw and *mangle as desired. For each ta-
       ble a corresponding COMMIT statement is required.

       After  modifying  any  of these files, you must reload ufw for the rules to take effect.  See the EXAMPLES section for common uses of these
       rules files.

MODULES

       Netfilter has many different connection tracking modules. These modules are aware of the underlying protocol and allow the administrator to
       simplify  his  or  her rule sets. You can adjust which netfilter modules to load by adjusting IPT_MODULES in /etc/default/ufw. Some popular
       modules to load are:

	 nf_conntrack_ftp
	 nf_nat_ftp
	 nf_conntrack_irc
	 nf_nat_irc
	 nf_conntrack_netbios_ns
	 nf_conntrack_pptp

KERNEL PARAMETERS

       ufw will read in /etc/ufw/sysctl.conf on boot when  enabled.   Please  note  that  /etc/ufw/sysctl.conf	overrides  values  in  the  system
       systcl.conf (usually /etc/sysctl.conf). Administrators can change the file used by modifying /etc/default/ufw.

IPV6
       IPv6  is  enabled by default. When disabled, all incoming, outgoing and forwarded packets are dropped, with the exception of traffic on the
       loopback interface.  To adjust this behavior, set IPV6 to 'yes' in /etc/default/ufw. See the ufw manual page for details.

EXAMPLES

       As mentioned, ufw loads its rules files into the kernel by using the iptables-restore and ip6tables-restore commands. Users wanting to  add
       rules  to  the  ufw  rules files manually must be familiar with these as well as the iptables and ip6tables commands. Below are some common
       examples of using the ufw rules files.  All examples assume IPv4 only and that DEFAULT_FORWARD_POLICY in /etc/default/ufw is set to DROP.

   IP Masquerading
       To allow IP masquerading for computers from the 10.0.0.0/8 network to share the single IP address on eth0:

       Edit /etc/ufw/sysctl.conf to have:
	       net.ipv4.ip_forward=1

       Add to the end of /etc/ufw/before.rules, after the *filter section:
	       *nat
	       :POSTROUTING ACCEPT [0:0]
	       -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
	       COMMIT

       If your firewall is using IPv6 tunnels or 6to4 and is also doing NAT, then you should not usually masquerade protocol '41' (ipv6)  packets.
       For example, instead of the above, /etc/ufw/before.rules can be adjusted to have:
	       *nat
	       :POSTROUTING ACCEPT [0:0]
	       -A POSTROUTING -s 10.0.0.0/8 --protocol ! 41 -o eth0 -j MASQUERADE
	       COMMIT

   Port Redirections
       To forward tcp port 80 on eth0 to go to the webserver at 10.0.0.2:

       Edit /etc/ufw/sysctl.conf to have:
	       net.ipv4.ip_forward=1

       Add to the *filter section of /etc/ufw/before.rules:
	       -A ufw-before-forward -m state --state RELATED,ESTABLISHED 
		 -j ACCEPT
	       -A ufw-before-forward -m state --state NEW -i eth0 
		 -d 10.0.0.2 -p tcp --dport 80 -j ACCEPT

       Add to the end of /etc/ufw/before.rules, after the *filter section:
	       *nat
	       :PREROUTING ACCEPT [0:0]
	       -A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT 
		 --to-destination 10.0.0.2:80
	       COMMIT

   Egress filtering
       To block RFC1918 addresses going out of eth0:

       Add in the *filter section of /etc/ufw/before.rules:
	       -A ufw-before-forward -o eth0 -d 10.0.0.0/8 -j REJECT
	       -A ufw-before-forward -o eth0 -d 172.16.0.0/12 -j REJECT
	       -A ufw-before-forward -o eth0 -d 192.168.0.0/16 -j REJECT

   Full example
       This  example combines the other examples and demonstrates a simple routing firewall. Warning: this setup is only an example to demonstrate
       the functionality of the ufw framework in a concise and simple manner and should not be used in production without understanding what  each
       part does and does not do. Your firewall will undoubtedly want to be less open.

       This  router/firewall has two interfaces: eth0 (Internet facing) and eth1 (internal LAN). Internal clients have addresses on the 10.0.0.0/8
       network and should be able to connect to anywhere on the Internet. Connections to port 80 from the Internet should be forward to  10.0.0.2.
       Access  to ssh port 22 from the administrative workstation (10.0.0.100) to this machine should be allowed. Also make sure no internal traf-
       fic goes to the Internet.

       Edit /etc/ufw/sysctl.conf to have:
		net.ipv4.ip_forward=1

       Add to the *filter section of /etc/ufw/before.rules:
	       -A ufw-before-forward -m state --state RELATED,ESTABLISHED 
		 -j ACCEPT

	       -A ufw-before-forward -i eth1 -s 10.0.0.0/8 -o eth0 -m state 
		 --state NEW -j ACCEPT

	       -A ufw-before-forward -m state --state NEW -i eth0 
		 -d 10.0.0.2 -p tcp --dport 80 -j ACCEPT

	       -A ufw-before-forward -o eth0 -d 10.0.0.0/8 -j REJECT
	       -A ufw-before-forward -o eth0 -d 172.16.0.0/12 -j REJECT
	       -A ufw-before-forward -o eth0 -d 192.168.0.0/16 -j REJECT

       Add to the end of /etc/ufw/before.rules, after the *filter section:
	       *nat
	       :PREROUTING ACCEPT [0:0]
	       :POSTROUTING ACCEPT [0:0]
	       -A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT 
		 --to-destination 10.0.0.2:80
	       -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
	       COMMIT

       For allowing ssh on eth1 from 10.0.0.100, use the ufw command:
	       # ufw allow in on eth1 from 10.0.0.100 to any port 22 proto tcp

SEE ALSO

       ufw(8), iptables(8), ip6tables(8), iptables-restore(8), ip6tables-restore(8), sysctl(8), sysctl.conf(5)

AUTHOR

       ufw is Copyright 2008-2009, Canonical Ltd.

       ufw and this manual page was originally written by Jamie Strandboge <jamie@canonical.com>

August 2009															  UFW FRAMEWORK(8)