Ubuntu UFW 防火墙（1）

LInux原始的防火墙工具iptables由于过于繁琐,所以ubuntu系统默认提供了一个基于iptable之上的防火墙工具ufw。而UFW支持图形界面操作,只需在命令行运行ufw命令即能看到一系列的操作。接下来,就由专业运营香港服务器、美国服务器、韩国服务器等国外服务器的天下数据为大家介绍ubuntu系统防火墙的开启、关闭等常规操作命令。

启用ufw

sudo ufw enable
sudo ufw default deny

运行以上两条命令后,开启了防火墙,并在系统启动时自动开启。关闭所有外部对本机的访问,但本机访问外部正常。

开启和禁用

sudo ufw allow|deny [service]

打开或关闭某个端口,例如:

sudo ufw allow smtp 允许所有的外部IP访问本机的25/tcp (smtp)端口
sudo ufw allow 22/tcp 允许所有的外部IP访问本机的22/tcp (ssh)端口
sudo ufw allow 53 允许外部访问53端口(tcp/udp)
sudo ufw allow from 192.168.1.100 允许此IP访问所有的本机端口
sudo ufw allow proto udp 192.168.0.1 port 53 to 192.168.0.2 port 53
sudo ufw deny smtp 禁止外部访问smtp服务
sudo ufw delete allow smtp 删除上面建立的某条规则

查看防火墙状态

sudo ufw status

允许某特定 IP

sudo ufw allow from xxx.xxx.xx.xxx

删除 smtp 端口的许可

sudo ufw delete allow smtp

USAGE用法

[--dry-run]选项，仅显示运行结果而不实际运行

启动\关闭\重启

  ufw [--dry-run] enable|disable|reload

默认策略 允许\拒绝\拒绝并提示 [进入\发出\路由 的数据]

  ufw [--dry-run] default allow|deny|reject [incoming|outgoing|routed]

日志 启动\关闭\级别

  ufw [--dry-run] logging on|off|LEVEL

重置

  ufw [--dry-run] reset

规则、状态 [详细\序号]

  ufw [--dry-run] status [verbose|numbered]

显示“报告”

  ufw [--dry-run] show REPORT

[删除][插入 第 行] 允许\拒绝\拒绝并提示\限制 [数据 进入\发出][记录\全记录] 端口[/协议]

  ufw  [--dry-run]  [delete]   [insert   NUM]   allow|deny|reject|limit  [in|out]      [log|log-all] PORT[/PROTOCOL]

[规则][删除][插入 第 行] 允许\拒绝\拒绝并提示\限制 [数据 进入\发出[网络接口]][记录\全记录] [协议 ][来自[端口 ]][指向[端口**]

  ufw [--dry-run] [rule] [delete] [insert NUM] allow|deny|reject|limit [in|out [on INTERFACE]] [log|log-all]  [proto  PROTOCOL]  [from  ADDRESS  [port  PORT]]  [to  ADDRESS [port PORT]]

路由[删除][插入 第 行] 允许\拒绝\拒绝并提示\限制 [数据 进入\发出[网络接口]][记录\全记录] [协议 ][来自[端口 ]][指向[端口**]

  ufw  [--dry-run]  route [delete] [insert NUM] allow|deny|reject|limit [in|out on  INTERFACE] [log|log-all] [proto PROTOCOL] [from ADDRESS [port PORT]] [to ADDRESS [port PORT]]

删除第*行规则

  ufw [--dry-run] delete NUM

应用名 列表\信息\默认策略\更新

  ufw [--dry-run] app list|info|default|update

OPTIONS选项

  --version
         show program's version number and exit
         显示程序版本并退出

  -h, --help
         show help message and exit
         显示帮助并退出

  --dry-run
         don't modify anything, just show the changes
         不进行更改，仅显示更改内容

  enable 
         reloads firewall and enables firewall on boot.
         重启防火墙，设置为开机启动

  disable
         unloads firewall and disables firewall on boot
         停止防火墙，禁止开机启动

  reload 
         reloads firewall
         重启防火墙

  default allow|deny|reject DIRECTION
         change the default policy for traffic going DIRECTION, where DIRECTION is
         one of incoming, outgoing or routed. Note that existing rules  will  have
         to be migrated manually when changing the default policy. See RULE SYNTAX
         for more on deny and reject.
         改变传入\传出\路由的默认策略。已存在的规则可能需要进行手动修改。关于deny|reject的区别参见 SYNTAX

  logging on|off|LEVEL
         toggle logging. Logged packets use the LOG_KERN syslog facility.  Systems
         configured for rsyslog support may also log to /var/log/ufw.log. Specify‐
         ing a LEVEL turns logging on for the specified  LEVEL.  The  default  log
         level is 'low'.  See LOGGING for details.
         切换记录。日志记录使用的是LOG_KERN系统设备。系统日志保存于/var/log/ufw.log。LEVEL指定不同的级别 ，默认级别是‘低’。参见LOGGING 
  reset 
        Disables  and resets firewall to installation defaults. Can also give the
         --force option to perform the reset without confirmation.
         关闭并重置防火墙至默认安装状态。使用--force选项，无需等待确认。

  status
         show status of firewall and ufw managed rules.  Use  status  verbose  for
         extra  information.  In  the status output, 'Anywhere' is synonymous with
         'any' and '0.0.0.0/0'. Note that when using status,  there  is  a  subtle
         difference when reporting interfaces. For example, if the following rules
         are added:
         显示防火墙状态及规则。使用status  verbose显示额外信息。显示信息中'Anywhere'等同于 'any'和'0.0.0.0/0'。

需要注意的是报告有些微妙的差异。例如，加入以下规则：

允许来自192.168.0.0-192.168.255.255的数据通过eth0网卡进入主机

           ufw allow in on eth0 from 192.168.0.0/16

允许指向10.0.0.0-10.255.255.255的数据通过eth1网卡从本机发出

           ufw allow out on eth1 to 10.0.0.0/8

允许来自192.168.0.0-192.168.255.255通过eth0网卡收入的数据且指向10.0.0.0-10.255.255.255通过eth1网卡发出的数据经本机路由

           ufw  route  allow  in  on  eth0  out  on  eth1   to   10.0.0.0/8   from 192.168.0.0/16

         ufw status will output:
         显示信息为：

           To                         Action      From
           --                         ------      ----
           Anywhere on eth0           ALLOW       192.168.0.0/16
           10.0.0.0/8                 ALLOW OUT   Anywhere on eth1
           10.0.0.0/8 on eth1         ALLOW FWD   192.168.0.0/16 on eth0

           指向                        行为        来自
           -----                        ------      ----
          任意地址，网络接口eth0        允许       192.168.0.0/16
           10.0.0.0/8           允许发出            任意地址，网络接口eth1
           10.0.0.0/8域，网络接口eth1       允许路由   192.168.0.0/16域，网络接口eth0

         For the input and output rules, the interface is reported relative to the
         firewall system as an endpoint, whereas with route rules,  the  interface
         is reported relative to the direction packets flow through the firewall.
         进入\发出 规则，（来自\指向）是以防火墙系统为终点的；路由规则，（来自\指向）是相对于通过防火墙的流向。

  show REPORT
         display information about the running firewall. See REPORTS
         显示运行中的防火墙信息。参见REPORTS

  allow ARGS
         add allow rule.  See RULE SYNTAX
         增加允许规则。参见 RULE SYNTAX

  deny ARGS
         add deny rule.  See RULE SYNTAX
         增加拒绝规则。参见 RULE SYNTAX

  reject ARGS
         add reject rule.  See RULE SYNTAX
         增加抵制规则。参见 RULE SYNTAX

  limit ARGS
         add limit rule.  Currently only IPv4 is supported.  See RULE SYNTAX
         增加限制规则。目前仅适用于IPv4。参见 RULE SYNTAX

  delete RULE|NUM
         deletes the corresponding RULE
         删除对应RULE

  insert NUM RULE
         insert the corresponding RULE as rule number NUM
         以规则号NUM插入对应RULE

RULE SYNTAX规则语法

  Users  can specify rules using either a simple syntax or a full syntax. The sim‐
  ple syntax only specifies the port and optionally the protocol to be allowed  or
  denied on the host. For example:
  用户可以使用简略或完全语法指定规则。简略语法仅指定端口、可选协议被主机允许\拒绝。例如：

允许使用53端口

    ufw allow 53

  This rule will allow tcp and udp port 53 to any address on this host. To specify
  a protocol, append '/protocol' to the port. For example:
  规则意为，允许本机通过53端口使用tcp udp协议指向任意地址的信息（一个物理网卡可以包含1或多个IP地址）。指定协议，在端口后加 / 即可。例如：

允许使用通过tcp协议使用25端口

    ufw allow 25/tcp

  This will allow tcp port 25 to any address on this host.  ufw  will  also  check
  /etc/services for the port and protocol if specifying a service by name.  Eg:
  规则意为，允许本机通过25端口使用tcp协议指向任意地址（进入）的信息。如果指定服务名称，ufw会通过检查/etc/services文件获得端口、协议信息。例如：

允许smtp应用

    ufw allow smtp

  ufw  supports both ingress and egress filtering and users may optionally specify
  a direction of either in or out for either incoming or outgoing traffic.  If  no
  direction is supplied, the rule applies to incoming traffic. Eg:
  ufw同时支持出、入过滤。用户可以使用in\out规定任意方向进出的数据。如果未指定方向，规则将应用于进入的数据。如：

允许http应用数据进入本机

    ufw allow in http

拒绝并告知：拒绝从本机发出smtp应用数据

    ufw reject out smtp

  Users  can  also  use  a  fuller  syntax,  specifying the source and destination
  addresses and ports. This syntax is loosely based on OpenBSD's  PF  syntax.  For
  example:
  用户也可以使用完整语法，指明来源\目标，地址，端口。该语法是OpenBSD PF语法的简约版。例如：

拒绝指向任意地址使用80端口tcp协议的数据进入本机

    ufw deny proto tcp to any port 80

  This will deny all traffic to tcp port 80 on this host. Another example:
  该规则：本机拒绝80端口使用tcp协议指向任意地址（进入）的信息。再如：

拒绝来自10.0.0.0/8域tcp协议指向192.168.0.1端口25的数据进入本机

    ufw deny proto tcp from 10.0.0.0/8 to 192.168.0.1 port 25

  This  will deny all traffic from the RFC1918 Class A network to tcp port 25 with
  the address 192.168.0.1.
  该规则将阻断（拒绝）所有来自RFC1918 A级网络（10.0.0.0-10.255.255.255）通过25端口使用tcp协议发送到192.168.0.1的信息。

拒绝来自 2001:db8::/32域指向任意地址端口25的数据进入本机

    ufw deny proto tcp from 2001:db8::/32 to any port 25

  This will deny all traffic from the IPv6 2001:db8::/32 to tcp port  25  on  this
  host. IPv6 must be enabled in /etc/default/ufw for IPv6 firewalling to work.
  该规则将拒绝本机接收所有来自IPv6 2001:db8::/32 通过25端口使用tcp（进入）的信息。/etc/default/ufw配置文件需开通IPv6功能。

允许来自任意地址使用tcp协议指向任意地址使用端口80、443、8080-8090的数据进入本机

    ufw allow proto tcp from any to any port 80,443,8080:8090

  The  above  will allow all traffic to tcp ports 80, 443 and 8080-8090 inclusive.
  When specifying multiple ports, the ports list must be numeric,  cannot  contain
  spaces  and  must  be  modified  as a whole. Eg, in the above example you cannot
  later try to delete just the '443' port. You cannot specify more than  15  ports
  (ranges count as 2 ports, so the port count in the above example is 4).
  该规则允许本机通过80、443，8080至8090端口使用tcp协议（进入）的信息。指定多个端口时，只能使用数字，且不能含空格。修改规则时需整条规则修改。在上面的例子中，你不能仅仅删除443端口。每次指定不能超过15个端口（端口区间视为2个端口，上面例子视为4个端口）

  Rules  for traffic not destined for the host itself but instead for traffic that
  should be routed/forwarded through the firewall should specify the route keyword
  before  the  rule (routing rules differ significantly from PF syntax and instead
  take into account netfilter FORWARD chain conventions). For example:
  规则中数据目标不是本机，是经本机防火墙路由\转发，规则前需加关键字route（路由规则与PF语法有明显的不同，替之以FORWARD链转换）。

允许经eth1进入，eth2发出的数据经本机路由

    ufw route allow in on eth1 out on eth2

  This will allow all traffic routed to eth2 and coming in on eth1 to traverse the
  firewall.
  该规则允许数据由eth1网卡进入路由至eth2网卡发出。

允许经eth0进入eth1发出指向 12.34.45.67使用80端口tcp的数据经本机路由

    ufw route allow in on eth0 out on eth1 to 12.34.45.67 port 80 proto tcp

  This  rule  allows any packets coming in on eth0 to traverse the firewall out on
  eth1 to tcp port 80 on 12.34.45.67.
  该规则允许数据经eth0网卡进入路由至eth1网卡通过80端口使用tcp协议发送至IP12.34.45.56？

  In addition to routing rules and policy, you  must  also  setup  IP  forwarding.
  This may be done by setting the following in /etc/ufw/sysctl.conf:
  增加路由规则前必需设置IP转发。该配置文件/etc/ufw/sysctl.conf，配置内容应如下：

    net/ipv4/ip_forward=1
    net/ipv6/conf/default/forwarding=1
    net/ipv6/conf/all/forwarding=1

  then restarting the firewall:
  再使用以下命令重启防火墙：

    ufw disable
    ufw enable

  Be  aware  that  setting  kernel  tunables  is operating system specific and ufw
  sysctl settings may be overridden. See the sysctl manual page for details.
  请小心，该操作系统内核可调参数设置会覆盖ufw内核（sysctl）设置。参见sysctl手册。




  ufw supports connection rate limiting, which is useful  for  protecting  against
  brute-force  login  attacks.  When a limit rule is used, ufw will normally allow
  the connection but will deny connections if an IP address attempts to initiate 6
  or   more  connections  within  30  seconds.  See  http://www.debian-administra‐
  tion.org/articles/187 for details. Typical usage is:
  ufw支持连接次数限制。可用于对抗暴力登录攻击。启用限制规则后，ufw允许连接，但30秒内连接次数高于6次时拒绝该IP访问。参见http://www.debian-administration.org/articles/187。典型用法如下：

限制ssh tcp协议连接本机次数

    ufw limit ssh/tcp




  Sometimes it is desirable to let the sender know when traffic is  being  denied,
  rather than simply ignoring it. In these cases, use reject instead of deny.  For
  example:
  有时需要让发送数据者知道数据被拒绝而不是失踪。在下面例子中，用户使用reject替换deny。例如：




    ufw reject auth




  By default, ufw will apply rules to all available  interfaces.  To  limit  this,
  specify  DIRECTION  on INTERFACE, where DIRECTION is one of in or out (interface
  aliases are not supported).  For example, to allow all new incoming http connec‐
  tions on eth0, use:
  默认情况下，ufw将规则应用于所有可用网络接口。也可把规则指定到特定的网络接口，包括网络接口数据进出方向（不支持网络接口别名）。例如允许数据通过eth0网卡使用http协议进入主机，写法如下：

允许通过eth0指向任意地址端口80协议tcp的数据进入本机

    ufw allow in on eth0 to any port 80 proto tcp




  To  delete  a rule, simply prefix the original rule with delete. For example, if
  the original rule was:
  要删除一条规则，在原规则前加delete就可以了。例如：原规则是这样的

    ufw deny 80/tcp

  Use this to delete it:
  删除时就这样写：

    ufw delete deny 80/tcp

  You may also specify the rule by NUM, as seen in the status numbered output. For
  example, if you want to delete rule number '3', use:
  你也可以使用status numbered参数查看规则序号。比如你想删除第3条规则，这样写就行了：

    ufw delete 3

  If  you  have  IPv6 enabled and are deleting a generic rule that applies to both
  IPv4 and IPv6 (eg 'ufw allow 22/tcp'), deleting by rule number will delete  only
  the  specified  rule.  To delete both with one command, prefix the original rule
  with delete.
  如果IPv6启用，你想删除一条同时适用于IPv4、IPv6的规则（如ufw allow 22/tcp），使用序号删除规则只会删除其中一条。一次性删

除干净就只能使用原规则前加delete的办法。

  To insert a rule, specify the new rule as normal, but prefix the rule  with  the
  rule  number  to  insert.  For  example, if you have four rules, and you want to
  insert a new rule as rule number three, use:
  为使用规则正常，你可以使用序号的方式插入新规则。例如，你有4条规则了，但你想把新规则放到第3的位置，可以这样写：把 拒绝来自 10.0.0.135协议tcp指向任意地址端口22的数据进入本机 指条命令插入到第3的位置 
    ufw insert 3 deny to any port 22 from 10.0.0.135 proto tcp

  To see a list of numbered rules, use:
  查询规则序号，使用命令：

    ufw status numbered




  ufw supports per rule logging. By default, no logging is performed when a packet
  matches  a  rule. Specifying log will log all new connections matching the rule,
  and log-all will log all packets matching the rule.  For example, to  allow  and
  log all new ssh connections, use:
  ufw支持规则运行状态日志。默认情况下符合规则的数据日志不显示。指定日志会记录下所有符合规则的数据、新连接。例如：允许并

记录所有新ssh连接。命令如下

    ufw allow log 22/tcp

  See LOGGING for more information on logging.
  参见LOGGING

EXAMPLES例子

  Deny all access to port 53:

拒绝所有通过53端口的数据

    ufw deny 53




  Allow all access to tcp port 80:

允许所有通过80端口使用tcp的数据

    ufw allow 80/tcp




  Allow all access from RFC1918 networks to this host:

允许所有来自RFC1918网络的数据进入本机

    ufw allow from 10.0.0.0/8
    ufw allow from 172.16.0.0/12
    ufw allow from 192.168.0.0/16




  Deny access to udp port 514 from host 1.2.3.4:

拒绝来自1.2.3.4主机通过514端口使用udp协议的数据

    ufw deny proto udp from 1.2.3.4 to any port 514




  Allow access to udp 1.2.3.4 port 5469 from 1.2.3.5 port 5469:

允许来自主机1.2.3.5端口5469的数据到达本机1.2.3.4使用端口5469协议udp

    ufw allow proto udp from 1.2.3.5 port 5469 to 1.2.3.4 port 5469

REMOTE MANAGEMENT远程管理

  When  running  ufw enable or starting ufw via its initscript, ufw will flush its
  chains. This is required so ufw can maintain a consistent state, but it may drop
  existing connections (eg ssh). ufw does support adding rules before enabling the
  firewall, so administrators can do:


    通过初始化脚本或命令启动ufw后，ufw将刷新连接。这是为了让ufw运行正常。但可能导致现有连接中断（如ssh）。ufw支持在启动前增加规则，在运行“ufw enable”命令前，管理者可以增加这个规则来进行远程管理： 
    ufw allow proto tcp from any to any port 22

  before running 'ufw enable'. The rules will still be flushed, but the  ssh  port
  will  be  open  after  enabling  the  firewall.  Please  note  that  once ufw is
  'enabled', ufw will not flush the chains when adding or removing rules (but will
  when  modifying  a  rule  or  changing the default policy). By default, ufw will
  prompt when enabling the firewall while running under ssh. This can be  disabled
  by using 'ufw --force enable'.

所有规则将被激活，ssh连接在启用防火墙时依然开通。请注意只要ufw处于'enabled'状态，增加或删除规则，都不进行连接刷新（改变默认策略或修改规则时除外）。默认情况，ufw如果处于ssh远程连接下，规则影响到ssh连接时都需要确认。使用ufw --force enable命令时，就不需要确认了。

APPLICATION INTEGRATION应用集成(强烈推荐此方法)

  ufw   supports   application   integration   by   reading  profiles  located  in
  /etc/ufw/applications.d. To list the names of application profiles known to ufw,
  use:

ufw支持查询/etc/ufw/applications.d文件完成应用集成。查看ufw已知应用集成（其它端口，由ubuntu在安装软件时自动定义，一般不需要自己新建。具体端口参见/etc/services），命令：
ufw app list

  Users  can  specify  an application name when adding a rule (quoting any profile
  names with spaces). For example, when using the simple syntax, users can use:

用户在增加规则时能使用应用名（引用带有空格的任何配置文件名称）。例如，使用如下简单语法：

    ufw allow <name>

  Or for the extended syntax:

或完整语法:

    ufw allow from 192.168.0.0/16 to any app <name>

  You should not specify the protocol with either syntax, and  with  the  extended
  syntax, use app in place of the port clause.

使用应用名代替端口时，语法中不能指定协议

  Details on the firewall profile for a given application can be seen with:

查看关于应用名的具体内容，使用如下命令。

    ufw app info <name>

  where  '<name>'  is  one  of  the  applications  seen with the app list command.
  User's may also specify all to see the profiles for all known applications.
  app list命令可以显示有哪些应用名。使用all代替应用名时，上面的命令会例出所有已知程序详细情况。

  After creating or editing an application profile, user's can run:

增加或编辑了应用名相关内容，请使用下面命刷新：

    ufw app update <name>

  This command will automatically update the firewall with updated profile  infor‐
  mation.  If  specify  'all' for name, then all the profiles will be updated.  To
  update a profile and add a new rule to the firewall  automatically,  user's  can
  run:

该命令将自动更新配置应用名。应用名为all时，会更新所有应用名。如果需要更新应用名配置且作为新规则加入防火墙，请使用下面的命令。

    ufw app update --add-new <name>

  The behavior of the update --add-new command can be configured using:


--add-new 命令参数进行更新时，其行为方式可由下面的命令指定 
    ufw app default <policy>

  The  default  application  policy is skip, which means that the update --add-new
  command will do nothing. Users may also specify a policy of allow or deny so the
  update --add-new command may automatically update the firewall.  WARNING: it may
  be a security to risk to use a default allow policy  for  application  profiles.
  Carefully  consider the security ramifications before using a default allow pol‐
  icy.


默认应用策略是跳过，也就意味着 --add-new 命令参数实际上没设定策略。用户能指定策略为allow或deny, 那之后--add-new 参数将自动更新防火墙。警告：使用allow策略作为应用策略将有安全风险。使用默认允许的政策之前，要仔细考虑的安全后果。 

LOGGING日志

  ufw supports multiple logging levels. ufw defaults to a loglevel of 'low' when a
  loglevel is not specified. Users may specify a loglevel with:

ufw支持多种日志级别。默认为“低”。用户可使用下面的命令指定日志级别：

    ufw logging LEVEL

  LEVEL  may  be 'off', 'low', 'medium', 'high' and 'full'. Log levels are defined
  as:


级别分为 关闭\低\中\高\完全。区别如下： 
  off    disables ufw managed logging

关闭 关闭日志记录

  low    logs all blocked packets not matching the default policy (with rate  lim‐
         iting), as well as packets matching logged rules


低 记录所有被默认策略阻止的数据（速率限制），以及符合规则的数据。 
  medium log  level low, plus all allowed packets not matching the default policy,
         all INVALID packets, and all new connections.  All logging is  done  with
         rate limiting.


中 低级别+不符合默认策略是数据+无效数据+所有新连接。所有记录在速率限制下进行。 
  high   log level medium (without rate limiting), plus all packets with rate lim‐
         iting


高 中级（取消速率限制）+速率限制下的所有数据包 
  full   log level high without rate limiting


完全 高级无速率限制。 



  Loglevels above medium generate a lot of logging output, and may quickly fill up
  your  disk.  Loglevel medium may generate a lot of logging output on a busy sys‐
  tem.


中级别以可能产生大量日志，有可能快速填满硬盘。对繁忙的系统而言，中级别就会有大量日志产生。 
  Specifying 'on' simply enables logging at log level 'low'  if  logging  is  cur‐
  rently not enabled.


on参数在没启用日志时，默认指定为低级别。 

REPORTS报告

  The  following  reports are supported. Each is based on the live system and with
  the exception of the listening report, is in raw iptables format:

支持如下报告。它们均基于活动系统排外的监听报告，属于原始的iptable形式。

    raw
    builtins
    before-rules
    user-rules
    after-rules
    logging-rules
    listening
    added

  The raw report shows the complete firewall, while the others show  a  subset  of
  what is in the raw report.


raw显示完整报告。其它级别在此基础上精简。 
  The  listening report will display the ports on the live system in the listening
  state for tcp and the open state for udp, along with the address of  the  inter‐
  face  and  the  executable listening on the port. An '*' is used in place of the
  address of the interface when the executable is bound to all interfaces on  that
  port. Following this information is a list of rules which may affect connections
  on this port. The rules are listed in the order they are evaluated by  the  ker‐
  nel, and the first match wins. Please note that the default policy is not listed
  and tcp6 and udp6 are shown only if IPV6 is enabled.


报告显示活动系统监听下的tcp upd状态及地址 网络接口，以及可监听的端口。*号代表该端口绑定到网络接口。该信息之下是所有能影响到该端口连接的规则。规则的监听由内核、第1匹配wins排序。注意默认策略未被监听，tcp6 udp6只有在IPv6启用的情况下有效。 
  The added report displays the list of rules as  they  were  added  on  the  com‐
  mand-line.  This  report  does  not show the status of the running firewall (use
  'ufw status' instead). Because rules are normalized by ufw, rules may look  dif‐
  ferent  than the originally added rule. Also, ufw does not record command order‐
  ing, so an equivalent ordering is used which lists IPv6-only rules  after  other
  rules.


新增报告将显示规则加入时的命令列表。报告不显示防火墙此时的运行状态（请使用ufw status命查询）。因为规则已被ufw标准化，看起来与加入时原规则不同了。此外，UFW不记录命令排序，所以等效排序，仅IPv6的规则位于其他规则后。 

NOTES注意

  On  installation,  ufw  is  disabled  with  a default incoming policy of deny, a
  default forward policy of deny, and a default outgoing  policy  of  allow,  with
  stateful  tracking  for  NEW connections for incoming and forwarded connections.
  In addition to the above, a default ruleset is put in place that does  the  fol‐
  lowing:

安装后，ufw不启动，默认策略：进入数据拒绝，转发拒绝，发出数据允许。默认策略跟踪进入\转发的新连接。除此外还增加了下列默认规则集：

  - DROP packets with RH0 headers

丢弃含RH0头的数据

  - DROP INVALID packets

丢弃无效数据

  -  ACCEPT  certain  icmp  packets  (INPUT and FORWARD): destination-unreachable,
  source-quench, time-exceeded, parameter-problem, and echo-request for IPv4. des‐
  tination-unreachable,   packet-too-big,  time-exceeded,  parameter-problem,  and
  echo-request for IPv6.

接受部分ICMP数据包（进入\转发）：IPv4：目的地不可达，源结束，超过时间，参数问题，回声请求。IPv6：目的地不可达，分组太大而，超过时间，参数问题，回声请求。

  - ACCEPT icmpv6 packets for stateless autoconfiguration (INPUT)

接受ICMPv6报文的无状态自动配置（进入）

  - ACCEPT ping replies from IPv6 link-local (ffe8::/10) addresses (INPUT)

接受IPv6链路本地地址（ffe8::/10）ping应答（进入）

  - ACCEPT DHCP client traffic (INPUT)

接受DHCP客户端数据（进入）

  - DROP non-local traffic (INPUT)

丢弃非本地通讯（进入）

  - ACCEPT mDNS (zeroconf/bonjour/avahi 224.0.0.251  for  IPv4  and  ff02::fb  for
  IPv6) for service discovery (INPUT)

接受mDNS服务（zeroconf/bonjour/avahi 等协议使用，IPv4 224.0.0.251,IPv6 ff02::fb）（进入）

  -  ACCEPT  UPnP (239.255.255.250 for IPv4 and ff02::f for IPv6) for service dis‐
  covery (INPUT)

接受UPnP服务(IPv4：239.255.255.250 ，IPv6：ff02::f ) （进入）

  Rule ordering is important and the  first  match  wins.  Therefore  when  adding
  rules, add the more specific rules first with more general rules later.

规则的顺序很重要，依次匹配执行。因此先添加针对性强的规则，再添加影响广泛的规则。

  ufw  is  not intended to provide complete firewall functionality via its command
  interface, but instead provides an easy way to add or remove simple rules.

UFW不打算通过自身命令提供完整的防火墙功能，而是提供了一种简单的方法来添加或删除简单的规则。

  The status command shows basic information about the state of the  firewall,  as
  well as rules managed via the ufw command. It does not show rules from the rules
  files in /etc/ufw. To see the complete state of the firewall, users can ufw show
  raw.  This displays the filter, nat, mangle and raw tables using:

status命令显示防火墙的状态及通过UFW命令管理的基本信息规则。它不显示/ etc/ UFW文件的规则。要查看防火墙的完整状态，用户可以UFW显示原料。这将显示过滤，NAT，损坏和原始表，命令如下：

iptables -n -L -v -x -t <table>
ip6tables -n -L -v -x -t <table>
  See the iptables and ip6tables documentation for more details.

更多信息查看iptables ip6tables

  If  the default policy is set to REJECT, ufw may interfere with rules added out‐
  side of the ufw framework. See README for details.

如果默认策略设置为REJECT，UFW可能会干扰UFW框架之外添加的规则。

  IPV6 is allowed by default. To change this behavior to only accept IPv6  traffic
  on  the loopback interface, set IPV6 to 'no' in /etc/default/ufw and reload ufw.
  When IPv6 is enabled, you may specify rules in the same way as for  IPv4  rules,
  and  they will be displayed with ufw status. Rules that match both IPv4 and IPv6
  addresses apply to both IP versions. For example, when IPv6 is enabled, the fol‐
  lowing rule will allow access to port 22 for both IPv4 and IPv6 traffic:

IPv6是默认允许。改变这种行为，只接受在回环接口上的IPv6数据，在/ etc/default/ UFW将IPv6设置为“no”，并重新加载UFW。

当启用IPv6，则可以以相同的方式针对IPv4规则指定的规则，它们将在ufw status命令下被显示。同时匹配IPv4和IPv6地址的规则适用于两个IP版本。

例如，当启用IPv6，下面的规则将同时允许IPv4和IPv6访问端口22为：

    ufw allow 22

  IPv6  over  IPv4  tunnels  and  6to4  are supported by using the 'ipv6' protocol
  ('41'). This protocol can only be used with the full syntax. For example:

IPv4借用IPv6进行封装时，需使用第41号协议。书写时使用proto ipv6，并且使用完整语法。例如：

    ufw allow to 10.0.0.1 proto ipv6
    ufw allow to 10.0.0.1 from 10.4.0.0/16 proto ipv6

  IPSec is supported by using the 'esp' ('50') and 'ah'  ('51')  protocols.  These
  protocols can only be used with the full syntax. For example:

支持使用“Internet 协议安全性 (IPSec)”协议，协议书写为esp \ ah（分别是50号\51号协议）。语法必需使用完整结构。例如：

    ufw allow to 10.0.0.1 proto esp
    ufw allow to 10.0.0.1 from 10.4.0.0/16 proto esp
    ufw allow to 10.0.0.1 proto ah
    ufw allow to 10.0.0.1 from 10.4.0.0/16 proto ah

  In  addition  to the command-line interface, ufw also provides a framework which
  allows administrators to modify default behavior as well as take full  advantage
  of netfilter. See the ufw-framework manual page for more information.

作者：功夫猫星人
链接：https://www.jianshu.com/p/6dc966f48b1f
來源：简书