Firewall – enabling ufw disables some of the settings in sysctl.conf

firewallsysctlufw

When I add rules to ufw and then enable it, some of my settings in sysctl.conf become void so I have to do sysctl -p after doing ufw enable.

So for example one of my settings in sysctl.conf is to not reply to ping, after enabling ufw, you can ping the server again.

Why is this?

Here are some of the settings in my sysctl.conf:

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.icmp_echo_ignore_all = 1
kernel.panic = 10
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
kernel.sysrq = 0
net.ipv4.ip_local_port_range = 1204 65000
net.core.rmem_max = 262140
net.core.rmem_default = 262140
net.ipv4.tcp_rmem = 4096 131072 262140
net.ipv4.tcp_wmem = 4096 131072 262140
net.ipv4.tcp_sack = 0
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_window_scaling = 0
net.ipv4.tcp_keepalive_time = 60000
net.ipv4.tcp_keepalive_intvl = 15000
net.ipv4.tcp_fin_timeout = 30

EDIT

Thank you Aaron!
I have come to rely on Google so much that I didn't think of inspecting the config files for ufw in etc – and there it was, so easy!

For anyone looking for an answer to this, you can either set your config in that file or even better, edit /etc/default/ufw file so it uses the system default sysctl.conf file in /etc/sysctl.conf

Best Answer

UncomplicatedFirewall

UFW has it's own sysctl settings that can override the system global settings.

Please take a look at:

/etc/ufw/sysctl.conf

If that file does not exist, grep through the files in that directory for anything calling sysctl.

Related Topic