In short, sell me on ufw.
I learned recently that yfw is basically replacing iptables "everywhere", and as I'm getting old and crusty, this means that I have to learn something new when I'd much rather practice yelling at kids to get off my lawn.
To me, iptables is fine, and I like its flexibility. I've been using it ever since it de facto replaced ipchains, so ease of use isn'treally a factor in this equation.
So my more pointed question is: Can I just stick to iptables, or am I missing out on something that can only be done with ufw?
15 Comments
a14o@feddit.org · 28 pts · 1y
The way I understand it, ufw is a frontend for iptables. So no.
dan@upvote.au · 17 pts · 1y
These days it's a frontend for nftables. iptables is a legacy system that's eventually going to be removed (just like ipchains before it).
On modern systems, iptables is a wrapper around nftables. So you're essentially using nftables except without the ability to use any of its more powerful features.
walthervonstolzing@lemmy.ml · 3 pts · 1y
I was about to say the same -- and also: nftables syntax is a lot cleaner compared to iptables, and the whole configuration can be loaded from a single file just like pf, without doing the dump/reload cycle that iptables required. Unless UFW does features like defining zones which a user might need (like firewalld), then it's not a huge improvement on bare nftables usability-wise.
IsoKiero@sopuli.xyz · 3 pts · 1y
Exactly. You can build rules with ufw and view them on iptables. Maybe the one thing ufw does better out of the box is persistent rules and simpler "firewall on/off" switch, but specially on this particular question I don't think they matter.
iii@mander.xyz · 10 pts · 1y
UFW is an interface to a subset of iptables.
There's things iptables can do that UFW can't. Nothing that UFW does, is impossible to do with iptables.
By why might one use UFW I hear you wonder? Convenience.
If you already master the art of iptables, no reason to learn UFW instead.
mlflexer@lemm.ee · 9 pts · 1y
I thought nftables where replacing iptables?
Shimitar@downonthestreet.eu · 5 pts · 1y
I think you got it wrong. Nft is replacing iptables. Ufw is only a frontend.
Actually, your uoyabled might just be a wrapper on nft.
marauding_gibberish142@lemmy.dbzer0.com · 4 pts · 1y
UFW syntax is easier. And it wraps nftables now which means I don't have to bother learning even more arcane syntax.
a_fancy_kiwi@lemmy.world · 3 pts · 1y
If you know iptables, just stick with that. In my testing, docker containers seem to ignore ufw rules. Supposedly, iptable rules are respected but I haven't learned iptables yet so I can't verify.
iii@mander.xyz · 5 pts · 1y
There's a forked ufw specifically to solve docker's issues. (1)
But yes, docker + ufw is something to be carefull about.
dan@upvote.au · 2 pts · 1y
Docker really doesn't like firewalls, and doesn't seem to play nicely with them.
Xanza@lemm.ee · 3 pts · 1y
UFW is a wrapper which just makes interfacing with iptables bearable. UFW is iptables.
dan@upvote.au · 2 pts · 1y
iptables is a legacy system that's going away. If you don't learn ufw, you'll have to learn nftables.
Edit: Not sure why I'm being downvoted for telling the truth lol
N0x0n@lemmy.ml · 1 pts · 1y
Don't know either, other than they can't stand the thruth for a good reason? :/ We have been using iptables for years and now we have to relearn everything?
dan@upvote.au · 2 pts · 1y
Yeah it's unfortunate. The nftables syntax is a lot easier though!
The same thing has happened before, around 15 years ago... Before iptables there was a system called ipchains. Migration took a while, but it was eventually done, and nobody talks about ipchains any more.