30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
---
|
|
title: "ufw"
|
|
category: "Backup, files and security"
|
|
tagline: "The Uncomplicated Firewall, turned on, with ufw-docker so containers can't get around it."
|
|
source: "pacman"
|
|
package: "ufw"
|
|
command: "ufw"
|
|
website: "https://launchpad.net/ufw"
|
|
code: "https://git.launchpad.net/ufw"
|
|
links:
|
|
- name: "ufw-docker"
|
|
url: "https://github.com/chaifeng/ufw-docker"
|
|
- name: "ufw on the Arch wiki"
|
|
url: "https://wiki.archlinux.org/title/Uncomplicated_Firewall"
|
|
---
|
|
|
|
## What it is
|
|
|
|
ufw, the Uncomplicated Firewall, is a front end to the Linux kernel's packet filter. Instead of writing firewall rules by hand, you allow or deny ports and addresses with short commands like `ufw allow 8080/tcp`.
|
|
|
|
## Why it's here
|
|
|
|
- **On from the start.** A desktop shouldn't accept connections it doesn't expect.
|
|
- **Readable rules.** `sudo ufw status` shows what's open in plain terms.
|
|
- **Docker-aware.** ufw-docker, from the AUR, stops published container ports from bypassing it.
|
|
|
|
## On CoreDesktop
|
|
|
|
CoreDesktop installs ufw from pacman and ufw-docker from the AUR, then turns the firewall on: incoming connections are blocked except SSH, mDNS, LocalSend and anything over Tailscale. The [System page](/system/#firewall) lists the rules and the commands to open a port, and [audit](/utilities/#audit) shows every open port and who can reach it. `update` keeps both packages current.
|