Is UFW mandatory?

[rattiraivo]

I've always wondered this question when it comes to minimal distros, because the guides usually rarely go over ufw directly. So if I wouldn't know of it's existence I wouldn't worry about it.

If it is mandatory, I followed the wiki page on the kernel options yet I'm being hit with these errors as I'm trying to enable it:

[pietinger]

No, "ufw" is not mandatory ... Do you really know what "ufw" is and what id does ?

Let me answer the question:

Our Linux kernel contains modules to filter network packets ... what is called a "firewall" ... Yes, the kernel is the FW. There are two applications that are able to pass filter rules to the kernel: iptables and nftables. You can use either of them.

There are also other applications such as "shorewall" and "ufw" ... which only generate rules that are THEN passed on to the kernel via iptables or nftables. I never recommend these two applications ! Why ? Because you always need to know what a FW - the kernel - can do and therefore you need to know the rules. "shorewall" is only suitable if you have to generate extensive filter rules (*) and "ufw" is there to generate simple rules ... which are unfortunately TOO simple == TOO insecure.

(* Even shorewall itself says in https://shorewall.org/Introduction.html : "Shorewall is not the easiest to use of the available iptables configuration tools but I believe that it is the most flexible and powerful. So if you are looking for a simple point-and-click set-and-forget Linux firewall solution that requires a minimum of networking knowledge, I would encourage you to check out the following alternatives: UFW (Uncomplicated Firewall), ipcop")

That's why I always recommend learning how to create rules with iptables or nftables native.

Do you know what a firewall can do ... and what it CANNOT do ?

Let me quote myself from this post: https://forums.gentoo.org/viewtopic-p-8465650.html#8465650

[rattiraivo]

Thanks for the detailed response. I knew beforehand that atleast iptables was the core so to speak, but I had no idea the kernel itself was the firewall.

[NeddySeagoon]

rattiraivo,

To generalise a bit, security is like the layers of a onion.
The idea is to assess your threats, then deploy the 'onion layers' to address those threats.

You will not keep a well resourced determined attacker out. See https://xkcd.com/538/

The idea is to discourage opportunists, so they attack someone else instead.

[rattiraivo]

I see now. Thanks.