Understanding UFW on Arch

iseektruth · 2021-06-13 19:50:53

Coming from Debian, and before that Ubuntu, I got used to UFW for managing firewall rules.

In Arch you can install UFW, but in order for UFW to work you have to disable the "iptables.service".

From my understanding, UFW sits on top of iptables, so disabling the iptables.service for UFW to be enabled on Arch, wouldn't that actually defeat the purpose of enabling UFW altogether, since enabling UFW stops iptables, and UFW is dependent on iptables?

On Debian and Ubuntu you don't have to manaully disable the iptables.service for UFW to be enabled.

loqs · 2021-06-13 20:13:43

UFW uses iptables. It does not use iptables.service. iptables.service is a simple service that loads iptables from a file. Is iptables.service actually enabled?

kweble55 · 2021-06-13 20:35:34

loqs wrote:

UFW uses iptables. It does not use iptables.service. iptables.service is a simple service that loads iptables from a file. Is iptables.service actually enabled?

How can you say that, yes, UFW uses iptables, but no, it does not use the iptables.service? iptables does not run if the iptables.service is disabled, and yes, by default the iptables.service is enabled on Arch.

jasonwryan · 2021-06-13 20:42:06

kweble55 wrote:

loqs wrote:
UFW uses iptables. It does not use iptables.service. iptables.service is a simple service that loads iptables from a file. Is iptables.service actually enabled?
How can you say that, yes, UFW uses iptables, but no, it does not use the iptables.service? iptables does not run if the iptables.service is disabled, and yes, by default the iptables.service is enabled on Arch.

Wrong.

┌─[Centurion ~: «SSH»]
└─╼ systemctl status iptables
○ iptables.service - IPv4 Packet Filtering Framework
     Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
     Active: inactive (dead)
┌─[Centurion ~: «SSH»]
└─╼ systemctl status ufw
● ufw.service - CLI Netfilter Manager
     Loaded: loaded (/usr/lib/systemd/system/ufw.service; enabled; vendor preset: disabled)
     Active: active (exited) since Mon 2021-06-14 05:55:24 NZST; 2h 46min ago
    Process: 306 ExecStart=/usr/lib/ufw/ufw-init start (code=exited, status=0/SUCCESS)
   Main PID: 306 (code=exited, status=0/SUCCESS)
        CPU: 160ms

loqs · 2021-06-13 20:42:17

systemctl status iptables.service 
● iptables.service - IPv4 Packet Filtering Framework
     Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
     Active: inactive (dead)

iptables loads packet filtering rules into the kernel either through the legacy interface or the new nft interface. There is no iptables running in userspace performing any filtering.
It does not matter to the kernel what sends it the packet filtering rules to apply.

kweble55 · 2021-06-13 20:53:02

If the iptables.service is allready inactive by default, then why does Arch require that service to be manually disabled in order to use UFW? (It says so in the Arch wiki article for UFW).

jasonwryan · 2021-06-13 20:55:44

kweble55 wrote:

If the iptables.service is allready inactive by default, then why does Arch require that service to be manually disabled in order to use UFW? (It says so in the Arch wiki article for UFW).

It doesn't say that. It says disable it in the event you have already (previously) enabled it:

wiki wrote:

Note that this will not work if iptables.service is also enabled (and same for its ipv6 counterpart).

kweble55 · 2021-06-13 21:03:27

loqs wrote:

systemctl status iptables.service 
● iptables.service - IPv4 Packet Filtering Framework
     Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
     Active: inactive (dead)
iptables loads packet filtering rules into the kernel either through the legacy interface or the new nft interface. There is no iptables running in userspace performing any filtering.
It does not matter to the kernel what sends it the packet filtering rules to apply.

So what you are saying is that to the kernel, it does'nt matter if it is UFW sending the kernel the firewall rules or iptables? Howso does UFW sit on top of iptables then, if UFW does'nt need iptables, but can send the kernel firewall instructions on its own?

seth · 2021-06-13 21:10:34

Read those, return with specific questions if there're any left open:
https://wiki.archlinux.org/title/Iptables
https://wiki.archlinux.org/title/Uncomplicated_Firewall

kweble55 · 2021-06-13 21:24:51

seth wrote:

Read those, return with specific questions if there're any left open:
https://wiki.archlinux.org/title/Iptables
https://wiki.archlinux.org/title/Uncomplicated_Firewall

According to Wikipedia iptables is "userpace utility program", just like UFW is a program that run i userspace. Appparenty UFW sits on top of iptables, but the iptables.service is disabled. I am sorry then if this is a bit odd to wrap my head around.

So iptables is both in kernel space (according to the arch wiki), but is also the name of a userspace command line tool to write firewall rules. The wiki sure does not make this any simpler to understand, I'm sorry, but it does'nt. Call me stupid if you like, but the relationship between UFW and iptables is not very well explained.

loqs · 2021-06-13 21:39:20

ufw.service on start calls ufw-init start which uses iptables the command not the service to send rules to the kernel. After sending the rules to the kernel, that is the end of ufw's job hence the command exits.

seth · 2021-06-13 21:41:44

https://git.launchpad.net/ufw/tree/src/ … ptables.py

ufw is a wrapper around iptables.
iptables is a userspace program to configure the package filter in the kernel - because it was *the* userspace program for a loooooooooooooong time, it's what the package filter is often called.
iptables.service is a system service that calls iptables-restore (see its manpage if you want)
Since the package filter is transient, *some* mechanism has to load the rules during or after the boot to make it do anything.
the iptables service and ufw load rules from different sources into the kernel package filter and trip over each other.

Arch Linux

#1 2021-06-13 19:50:53

Understanding UFW on Arch

#2 2021-06-13 20:13:43

Re: Understanding UFW on Arch

#3 2021-06-13 20:35:34

Re: Understanding UFW on Arch

#4 2021-06-13 20:42:06

Re: Understanding UFW on Arch

#5 2021-06-13 20:42:17

Re: Understanding UFW on Arch

#6 2021-06-13 20:53:02

Re: Understanding UFW on Arch

#7 2021-06-13 20:55:44

Re: Understanding UFW on Arch

#8 2021-06-13 21:03:27

Re: Understanding UFW on Arch

#9 2021-06-13 21:10:34

Re: Understanding UFW on Arch

#10 2021-06-13 21:24:51

Re: Understanding UFW on Arch

#11 2021-06-13 21:39:20

Re: Understanding UFW on Arch

#12 2021-06-13 21:41:44

Re: Understanding UFW on Arch

Board footer