---
title: "ufw"
category: "Backup, files and security"
tagline: "The Uncomplicated Firewall, turned on, with ufw-docker so containers can't get around it."
source: "pacman"
package: "ufw"
command: "ufw"
website: "https://launchpad.net/ufw"
code: "https://git.launchpad.net/ufw"
links:
  - name: "ufw-docker"
    url: "https://github.com/chaifeng/ufw-docker"
  - name: "ufw on the Arch wiki"
    url: "https://wiki.archlinux.org/title/Uncomplicated_Firewall"
---

## What it is

ufw, the Uncomplicated Firewall, is a front end to the Linux kernel's packet filter. Instead of writing firewall rules by hand, you allow or deny ports and addresses with short commands like `ufw allow 8080/tcp`.

## Why it's here

- **On from the start.** A desktop shouldn't accept connections it doesn't expect.
- **Readable rules.** `sudo ufw status` shows what's open in plain terms.
- **Docker-aware.** ufw-docker, from the AUR, stops published container ports from bypassing it.

## On CoreDesktop

CoreDesktop installs ufw from pacman and ufw-docker from the AUR, then turns the firewall on: incoming connections are blocked except SSH, mDNS, LocalSend and anything over Tailscale. The [System page](/system/#firewall) lists the rules and the commands to open a port, and [audit](/utilities/#audit) shows every open port and who can reach it. `update` keeps both packages current.