Question
UFW Application Profile Rule Precedence
Sora Orbit
0 reputation · 23 Aug 2020, 10:34 UTC
27.4K views1
Loading…
0 reputation · 23 Aug 2020, 10:34 UTC
The Uncomplicated Firewall (UFW) allows the activation of predefined service rules through application profiles. When a user executes ufw allow for a specific profile, UFW translates these profiles into underlying iptables or nftables rules.
A challenge arises when combining application profiles with custom manual rules. Since UFW processes rules linearly, the placement of profile-based rules relative to manual port restrictions can alter the effective security posture of the system.
It is unclear how UFW handles the insertion order when a profile is enabled after several manual rules have already been established. Specifically, if a manual 'deny' rule exists for a port that a subsequent application profile attempts to 'allow', the resulting priority may lead to unexpected traffic blocking or exposure.
31775 reputation · 23 Aug 2020, 20:01 UTC
When you run ufw allow , UFW translates the profile into an allow rule and appends it to the end of the ufw-user-input chain. Conversely, ufw deny inserts its rule at the beginning of the chain. Therefore, the order in which you enable profiles determines their relative priority: the first profile allowed appears higher (earlier) in the chain and wins over later profiles for the same port.
UFW does not examine the contents of a profile to reorder rules; it simply treats each allow or deny command as a generic rule insertion. Application profiles are just shortcuts that expand to those commands, so they follow the same insertion logic.
ubuntudeny rules are inserted at the start of the rule set.allow rules are appended to the end.ufw status numbered.iptables -L ufw-user-input -v -n (and ip6tables for IPv6).ufw insert allow to place it higher.ufw reload) and verify packet counters with a test connection.To give a definitive recommendation for your specific setup, please provide the exact sequence of ufw allow commands you have run (or the output of ufw status numbered) so we can confirm which profile rule appears higher in the chain.
Use comments to ask for clarification. Post a solution as an answer.
31,775 reputation · 23 Aug 2020, 20:30 UTC
The key insight is that UFW does not reorder rules based on their meaning—it follows a strict insertion pattern. When you run ufw allow , the generated rule is appended to the ufw-user-input chain. Conversely, ufw deny inserts at the beginning of the chain.
This means a manual deny for port 80 placed before enabling an SSH profile will block SSH traffic if the profile tries to allow port 22, because the deny is evaluated first. The profile cannot override an earlier rule—it can only be moved forward using ufw insert 1 allow .
ufw status numbered after each change to track rule order.iptables -L ufw-user-input -n --line-numbers to confirm actual chain position.ufw delete allow ) and re-insert at a lower number.In short: order matters, and UFW gives no special treatment to application profiles—they behave exactly like explicit allow or deny commands.