UFW Firewall

Status

Active — UFW is enabled with nftables backend.

Policies

Direction	Default Policy
Incoming	Deny
Outgoing	Allow
Routed	Deny

Rules

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)

Implementation

UFW manages nftables rulesets. Key chains:

• ufw-before-input — handles loopback, established connections, ICMP, DHCP
• ufw-user-input — user-defined allow rules (ports 22, 80, 443)
• DOCKER-USER — Docker's FORWARD chain integration

Notes

• All application containers bind to 127.0.0.1, so they are not affected by UFW FORWARD policy
• Docker uses iptables for NAT/port publishing (not bypassing UFW for localhost binds)