3

I am currently studying iptables and ufw on Ubuntu server. While playing with them I came across an ambiguity about the true nature of the ufw.

Here is the problem:

  • When I run sudo ufw status in terminal, the output is Status: inactive.

  • But when I run sudo service ufw status the output is ufw start/running.

Also ufw does not appear in the services list when I run service --status-all.

So my questions are:

  1. Is ufw a service?
    • If yes, why it does not appear in the services list?
    • If no, why the terminal answers when I ask about it's status as a service?
  2. What is the difference between sudo ufw status and sudo service ufw status? And why I get different outputs for them?
8
  • first of all, which version is this? Oct 18 '15 at 12:00
  • @AizuddinZali Ubuntu 14.04.3 LTS (GNU/Linux 3.19.0-25-generic x86_64)
    – Kobayashi
    Oct 18 '15 at 12:15
  • ok thats weird when you see ufw status and service ufw status not tally. Try to service ufw restart. Sometime this caused by pid file went missing. Oct 18 '15 at 12:19
  • @AizuddinZali I did perform the service ufw restart and it worked. Now I get the same result for both of the commands as: ufw start/running. Does this mean that they are identical commands?
    – Kobayashi
    Oct 18 '15 at 12:36
  • no they are not, service is part of init that call ufw program. While ufw is the program itself. Oct 18 '15 at 12:43
4

ufw is an uncomplicated configuration tool for firewalls. It is designed to be usable by people who have no experience with firewalls or want an uncomplicated way to modify the underlying iptables and netfilter rulesets.

For example:

ufw allow all port 22 traffic (UDP and TCP):

ufw allow 22

iptables allow port 22 traffic (UDP and TCP):

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p udp --dport 22 -j ACCEPT

Comparatively, ufw permits users to modify the basic firewall needs with limited knowledge of iptables or such.

It in and of itself only modifies iptables / netfilter rules when 'enabled'. It does not run as its own process, in that sense, because the rules it applies are updated on the fly; I am fairly certain it doesn't continue to 'run'.

The only way I would consider ufw to be a service is in that, at boot time, it may be able to restore whatever rules are defined in it. However, iptables-persistent does the same thing, and is not really a service, therefore I do not consider ufw a service, as such, as to determine if ufw (that is, the actual firewall rules) are being enforced is with ufw status.

As per the Community Help Documentation on ufw, it says nothing about ufw being a service, which seems to support this.

And through testing, I have confirmed that ufw is just a less complicated way to 'configure' firewall rules - the real magic of ufw is that it sets up iptables / netfilter rules which you can then see with iptables -L when ufw is enabled.

4
  • This chosen answer says that ufw is not a service, but there's a comment and another answer that says it is. I want to believe that ufw is effectively only a config editor, but this level of confusion gives me doubt.
    – gwideman
    Nov 5 '18 at 3:43
  • ... and prompted my own question at: askubuntu.com/questions/1090122/ufw-what-exactly-is-it
    – gwideman
    Nov 5 '18 at 13:48
  • @gwideman It in and of itself is "not a service" - it as a service is just the "on boot" loading of the ruleset. It's still not a 'service' in the traditional sense of a service or daemon that always runs, it just applies rules to the underlying netfilter/iptables which is always on and can't be turned off.
    – Thomas Ward
    Nov 5 '18 at 15:42
  • On investigating further, your comment seems to make almost the right distinction. ufw does seem to count as a service, in that 'service ufw status' shows it (ufw.service). But that listing reports 'loaded active exited', which seems to mean that its executable ran, did whatever it was configured to do (which could be nothing if its config doesn't say enabled), and then exited. So it's not listed in 'ps aux' as having a running process, as you noted.
    – gwideman
    Nov 5 '18 at 23:38
3
  • As far as the Ubuntu documentation, ufw is an application that is running as a system service.
  • No.2 question is simple....

    The two mentioned commands are quite different:

    • ufw status shows only if the firewall filtering is active, to enable it type sudo ufw enable.
    • service ufw status shows only if the service itself is operating.
1
  • 1
    Well, that's neat and tidy :-) but what does it mean for the 'ufw status' to be inactive, and the 'service ufw status' to be active (also exited)? You say this means the service is "operating" -- but in what sense of operating? It has no running process, and it provided no rules to iptables/netfilter. I acknowledge that service ufw status says it's active, which must mean something, but what?
    – gwideman
    Nov 5 '18 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.