I’ve been hearing more and more recent requests (at OpenWeek -chat and in blog comments) regarding a request for a GUI on top of ufw. I wanted to take a second and outline more clearly what ufw is, which will likely stop these requests. I think its just a simple matter of not truly understand what ufw does which leads to these. Bottom line, there are already a number of GUI firewall applications, adding one for ufw would be basically pointless. (Before you argue that point, keep reading.)
What is ufw?
ufw, or “uncomplicated firewall”, is simply a management tool for creating kernel-level firewall rules which is done via the netfilter kernel module and iptables userspace tool. iptables has been around for quite a long time, is very, very robust and very widely used. It is installed by default on any Ubuntu system, but no “rules” have historically been applied to it. (Technically, every Linux system has a firewall utility built into the kernel, but if no rules are applied to that filter nothing is actually being specifically allowed or denied.)
The reason ufw was developed (I sat in on the sprint at UDS for this) is that we wanted to create a server-level firewalling utility that was a little bit more “for human beings”. While iptables is already installed and available for use, the syntax can be complicated. For example, lets say you wanted to block all connections from the IP address 10.100.0.5:
iptables : sudo iptables -A INPUT -s 10.100.0.5 -j REJECT
ufw: sudo ufw deny from 10.100.0.5
Another slightly more complicated example could be written for blocking specific ports and protocols:
iptables: sudo iptables -A INPUT --dport 22 -s 10.100.0.5 -j REJECT
ufw: sudo ufw deny from 10.100.0.5 to any port 22
ufw is creating the iptables / netfilter rule “under the hood”, but allowing us to create the rules in a simpler way. Both of the commands above basically do the same thing, ufw simply “uncomplicates” the process.
For those that are looking for a GUI on top of ufw, remember that you already have tools such as Firestarter or lokkit, etc. Those are graphical tools which create and manage iptables / netfilter rules “under the hood”. ufw is simply a command-line tool to manage iptables / netfilter rules “under the hood”.
The existing GUI tools (Firestarter) and ufw both use iptables underneath, so adding a GUI to ufw would basically be re-creating Firestarter, which is not really needed. ufw is simply a less complicated way to create firewall (iptables) “rules” on the command line.