4 # Rules that should be run before the ufw command line added rules. Custom
5 # rules should be added to one of these chains:
11 # Don't delete these required lines, otherwise there will be errors
13 :ufw-before-input - [0:0]
14 :ufw-before-output - [0:0]
15 :ufw-before-forward - [0:0]
16 :ufw-not-local - [0:0]
20 # allow all on loopback
21 -A ufw-before-input -i lo -j ACCEPT
22 -A ufw-before-output -i lo -j ACCEPT
24 # connection tracking rules
25 -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
27 # drop INVALID packets
28 # uncomment to log INVALID packets
29 #-A ufw-before-input -m conntrack --ctstate INVALID -j LOG --log-prefix "[UFW BLOCK INVALID]: "
30 -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
32 # connection tracking for outbound
33 -A ufw-before-output -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
34 -A ufw-before-output -p udp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
37 -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
38 -A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
39 -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
40 -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
41 -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
43 # allow dhcp client to work
44 -A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
49 -A ufw-before-input -j ufw-not-local
52 -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
54 # if MULTICAST, RETURN
55 -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
57 # if BROADCAST, RETURN
58 -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
60 -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK NOT-TO-ME]: "
62 # all other non-local packets are dropped
63 -A ufw-not-local -j DROP
65 # allow MULTICAST, be sure the MULTICAST line above is uncommented
66 -A ufw-before-input -s 224.0.0.0/4 -j ACCEPT
67 -A ufw-before-input -d 224.0.0.0/4 -j ACCEPT
70 # don't delete the 'COMMIT' line or these rules won't be processed