13

I've removed ufw and I want to get rid of all the chains it leaves behind. How can I do that easily?

3 Answers 3

18

The answer from @flickerfly does not work in my situation. I run the following commands to get rid of all ufw roles and chains

for i in `iptables -L INPUT --line-numbers |grep '[0-9].*ufw' | cut -f 1 -d ' ' | sort -r `; do iptables -D INPUT $i ; done
for i in `iptables -L FORWARD --line-numbers |grep '[0-9].*ufw' | cut -f 1 -d ' ' | sort -r `; do iptables -D FORWARD $i ; done
for i in `iptables -L OUTPUT --line-numbers |grep '[0-9].*ufw' | cut -f 1 -d ' ' | sort -r `; do iptables -D OUTPUT $i ; done
for i in `iptables -L | grep 'Chain .*ufw' | cut -d ' ' -f 2`; do iptables -X $i ; done

1
  • 1
    Do you know what about your situation made my solution not work? Maybe mine has simply aged out. I'm not working with ufw anymore so can't test it. Thanks for updating it.
    – flickerfly
    Apr 4, 2019 at 18:01
15

Note: This has not aged well. Check out other answers for modern solutions first.

This two liner run as root will quickly find all the names and run them through a for loop that runs iptables -F to flush references to the chain then iptables -X to delete them.

for ufw in `iptables -L |grep ufw|awk '{ print $2 }'`; do iptables -F $ufw; done
for ufw in `iptables -L |grep ufw|awk '{ print $2 }'`; do iptables -X $ufw; done
3
  • 1
    I deleted my answer as it upset askubuntu.com/users/181795/yugi but I thought I'd add here, if you're not running this as root, you'll need add sudo to both iptables calls. Dec 4, 2017 at 10:51
  • Not working anymore in 2021, see @david-boho answer
    – rtribaldos
    Sep 30, 2021 at 18:06
  • 2
    Thanks @rtribaldos. I put a note at the top of this answer to save people from trying and failing I hope.
    – flickerfly
    Sep 30, 2021 at 19:19
0

iptables noob here, so please bear with me.

I know this is an older topic, but it helped me get on the right track.

TL;DR neither of the options presented by either @wjdp or @david-boho worked for me and I eventually found this comment on serverfault (hope I'm allowed to cross-share) delete a ip chain and all its references by user Steven Monday:

Try this: iptables-save | grep -v i_XXXXX_i | iptables-restore – Steven Monday Apr 2 '12 at 19:01

Replacing "i_XXXXX_i" with "ufw-" it did the job.

Hopefully needless to say I first backed up my iptables:

 iptables-save > ~/iptables-old

For my longer tale:

@wjdp : I think the first reason yours may appear to not work properly is that some of the output from "iptables -L" comes out as $1 instead of $2 eg:

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ufw-before-logging-forward  all  --  anywhere             anywhere            
ufw-before-forward  all  --  anywhere             anywhere          

this throws an error:

iptables: No chain/target/match by that name.

I used:

for ufw in `iptables -L | grep -oE "(^| )ufw[^ ]*( |$)" | awk '{ print $1}'`; do iptables -F $ufw; done
for ufw in `iptables -L | grep -oE "(^| )ufw[^ ]*( |$)" | awk '{ print $1}'`; do iptables -X $ufw; done

however, on investigation, it appears I was simply creating duplicates as the rule was re-referred to in the policy (appears as $1) and in the rule itself ($2).

A simple mod to your commands to get clean output would be:

for ufw in `iptables -L | grep -E  ^Chain.*ufw | awk '{ print $2 }'`; do iptables -F $ufw; done
for ufw in `iptables -L | grep -E  ^Chain.*ufw | awk '{ print $2 }'`; do iptables -X $ufw; done

I, however, then got the following errors when running -X (after having run -F):

iptables v1.8.2 (nf_tables):  CHAIN_USER_DEL failed (Device or resource busy): chain ufw-before-logging-input
iptables v1.8.2 (nf_tables):  CHAIN_USER_DEL failed (Device or resource busy): chain ufw-before-logging-output

I then tried @david-boho's "-D" option and got the following error:

iptables: Bad rule (does a matching rule exist in that chain?).

(I added an echo to David's command, and confirmed the names were indeed valid)

It was after this that I found Steven's solution that worked perfectly for me.

Hope this helps someone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .