Ufw reset vs. disable / enable

ufw

When is it appropriate to ufw reload versus ufw disable && ufw enable, and vice versa?

The reason for asking:

According to the ufw man page, "reload reloads firewall."

However, documentation provided by the community (e.g., here, here, and here), instructs us to activate new settings by running:

$ sudo ufw disable
$ sudo ufw enable

Best Answer

I believe sudo ufw reload simply reloads the rules, while sudo ufw enable actually calls the reload command and also enables it at reboot.

Now note that sudo ufw disable was run first so the need for sudo ufw enable, and that being said I believe using the above outlined steps for new changes to ufw rules is for emphasis as sudo ufw reload will still suffice. Test it and see if the new rules don't apply successfully.

Related Solutions

Linux – Disable Connection Tracking with UFW for Port 80

Connection tracking is an on/off switch, you cannot selectively disable it for some kind of traffic. You should increase the number of connections tracked via varius nf_conntrack_max options under /proc/sys/net. You can also consider enabling syncookies to reduce congestion effects.

Edit: It seems that iptables with -j NOTRACK allows you to disable connection tracking selectively.

Ubuntu – UFW Firewall Rules ordering

If you're interested in reordering your UFW rules, this is one way to do it.

$ sudo ufw status numbered

     To                         Action      From
     --                         ------      ----
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 80                         ALLOW IN    Anywhere
[ 3] 443                        ALLOW IN    Anywhere
[ 4] 22 (v6)                    ALLOW IN    Anywhere (v6)
[ 5] 80 (v6)                    ALLOW IN    Anywhere (v6)
[ 6] 443 (v6)                   ALLOW IN    Anywhere (v6)
[ 7] Anywhere                   DENY IN     [ip-to-block]

Say you accidentally added a rule to the end, but you wanted up top.

First you will have remove it from the bottom (7) and add it back.

$ sudo ufw delete 7

Note, be careful of removing multiple rules one after another, their position can change!

Add back your rule to the very top (1):

$ sudo ufw insert 1 deny from [ip-to-block] to any

Best Answer

Related Solutions

Linux – Disable Connection Tracking with UFW for Port 80

Ubuntu – UFW Firewall Rules ordering

Related Topic