1

I have a use case that needs iptables' ability to restrict a rule to a group id (--gid-owner). Ufw doesn't have support for this in its rule syntax.

From my experiments and reading online (e.g. UFW rules disappear after manually adding them to user.rules ubuntu 16.04) it seems ufw will reject any manually-added iptables rules. That is to say, I can edit /etc/ufw/user.rules and add -A ufw-user-output ... --gid-owner ... but because it's not prefixed with a magic ufw-correct comment (since no such syntax exists), it's ignored and erased.

Do I have to pick one of ufw or iptables or is there a way I can get the best of both worlds?

0

Take a look here: Ubuntu: How to add an iptables rule that UFW can't create

I added the netbios-ns helper to iptables, raw table using UFW config files under /etc/ufw/. (Taken from Arch Linux - Samba - source iptables command

iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns

).
This allows browsing an MS Windows network using Thunar as an example.

I added the translated syntax to the /etc/ufw/after.rules file, at the beginning, just after the initial comment block, see below:

#
# rules.input-after
#
# Rules that should be run after the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw-after-input
#   ufw-after-output
#   ufw-after-forward
#

# netbios helper function allow browsing windows network
*raw
-A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns
COMMIT

# Don't delete these required lines, otherwise there will be errors
[...]

Note: this syntax is the one used by iptables-save.

Then restart UFW.

Note that I had to insert at the beginning of the after.rules file, otherwise if I was appending at the end of the file, it was adding 3 times the same entry to the OUTPUT chain in the raw table once ufw was restarted.

It allowed me to avoid using the /etc/ufw/user.rules. Perhaps it is an option that you can consider.

I hope it may help.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.