# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-NET-005
title: Run exactly one host firewall
finding:
  title: No host firewall is active, or several firewall tools compete for the same rules
  description: Without a host firewall every listening service is reachable from the network; with several, rules overwrite each other in ways nobody planned.
status: active
profiles: [core]
risk:
  severity: high
assessment: automated
tags: [firewall, ufw, nftables, network]

description: |
  The Linux kernel filters packets with netfilter. On Ubuntu, its rules are managed by one of
  these tools, each started at boot by its own service:

  - `ufw`, a simple front end, active when `ufw status` shows `Status: active`;
  - `nftables`, rules loaded from `/etc/nftables.conf` by `nftables.service`;
  - `firewalld`;
  - `iptables-persistent`, rules restored by `netfilter-persistent.service`.

  This control requires exactly one of them to be enabled. Its default policy is covered by
  CB-UBU-NET-006.
rationale: |
  A host firewall limits the services reachable from the network to the ones that are meant to
  be, even when a package starts a new listener or a service binds to all addresses by mistake.
  Two firewall tools flush or reorder each other's rules on reload, which leaves the host either
  wide open or cut off after a restart.
impact: |
  The automatic fix installs and enables ufw when no firewall is active. It allows the SSH ports
  first, but ufw then drops every other incoming connection: services such as web or database
  servers become unreachable until they are allowed with `ufw allow <port>/<protocol>`. It is
  disabled by default; list the listening services with `ss -tulpn` and allow them before
  enabling it.
notes: |
  ufw is installed by default on every Ubuntu release but left inactive (`ENABLED=no` in
  `/etc/ufw/ufw.conf`); `ufw.service` is enabled anyway, which is why the check reads `ufw status`
  rather than the unit state. Ubuntu documents ufw and the CIS Benchmarks favour it; nftables,
  firewalld and iptables-persistent are accepted too. On 22.04 and later, iptables is the
  `iptables-nft` variant, so ufw rules also show in `nft list ruleset`: that does not count as a
  second firewall as long as `nftables.service` is not enabled. 20.04 uses the legacy iptables
  back end. Docker and libvirt add their own rules beside the host firewall; they are not counted.
  The fix reads the SSH ports from `sshd -T`; on 24.04 and later, where sshd is started by
  `ssh.socket`, it first creates `/run/sshd` if no connection has started the service yet, and
  stops without enabling ufw if it cannot find any port.

audit:
  manual: |
    1. `ufw status` (if installed): `Status: active` counts as one.
    2. `systemctl is-enabled nftables.service firewalld.service netfilter-persistent.service`:
       each `enabled` counts as one.
    Exactly one must be counted.
  checks:
    - id: single-firewall
      engine: shell
      description: Firewall tools enabled at boot.
      spec:
        script: |
          active=
          if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
            active="$active ufw"
          fi
          for u in nftables firewalld netfilter-persistent; do
            [ "$(systemctl is-enabled "$u.service" 2>/dev/null)" = enabled ] && active="$active $u"
          done
          echo "active firewall tools:${active:- none}"
          set -- $active
          [ "$#" -eq 1 ]

remediation:
  manual: |
    - No firewall: ufw is installed by default (otherwise `apt install ufw`). Allow SSH and the
      other services that must stay reachable, then enable it:
      ```
      ufw allow 22/tcp
      ufw enable
      ```
      Or write `/etc/nftables.conf` (see CB-UBU-NET-006) and run `systemctl enable --now nftables`.
    - Several tools: keep one, then disable the others, for example `ufw disable`,
      `systemctl disable --now nftables` or `apt purge iptables-persistent`.
  effects:
    restart: none
    disruption: high
    lockout_risk: true
  rollback: |
    Run `ufw disable`. Installed packages can stay.
  scripts:
    - id: enable-ufw
      engine: shell
      file: fix.sh

references:
  - title: ufw(8), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man8/ufw.8.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: Ubuntu Server documentation - Firewalls
    url: https://documentation.ubuntu.com/server/how-to/security/firewalls/
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: Ubuntu Security documentation - Firewall
    url: https://documentation.ubuntu.com/security/security-features/network/firewall/
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy
    url: https://csrc.nist.gov/pubs/sp/800/41/r1/final
    publisher: NIST
    kind: guide
    accessed: 2026-10-19
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SC-7
    relation: partial
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.1.1"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.2.1"
    relation: looser
    note: Ours accepts ufw, nftables, firewalld or iptables-persistent; CIS 20.04 describes one variant per tool.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.2.2"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.2.3"
    relation: looser
    note: Ours counts iptables-persistent only when netfilter-persistent.service is enabled, not when the package is merely installed.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.2.4"
    relation: looser
    note: Ours accepts ufw, nftables, firewalld or iptables-persistent; CIS 20.04 describes one variant per tool.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.3.1"
    relation: looser
    note: Ours accepts ufw, nftables, firewalld or iptables-persistent; CIS 20.04 describes one variant per tool.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.3.2"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.3.3"
    relation: partial
    note: Ours does not check that the iptables tables are empty when nftables is used.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.3.9"
    relation: looser
    note: Ours accepts ufw, nftables, firewalld or iptables-persistent; CIS 20.04 describes one variant per tool.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.4.1.1"
    relation: looser
    note: Ours accepts ufw, nftables, firewalld or iptables-persistent; CIS 20.04 describes one variant per tool.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.4.1.2"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "4.4.1.3"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "4.1.1"
    relation: looser
    note: Ours also accepts nftables, firewalld or iptables-persistent instead of ufw.
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "4.1.2"
    relation: looser
    note: Ours also accepts nftables, firewalld or iptables-persistent instead of ufw.
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "4.1.1"
    relation: looser
    note: Ours also accepts nftables, firewalld or iptables-persistent instead of ufw.
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "4.1.2"
    relation: looser
    note: Ours also accepts nftables, firewalld or iptables-persistent instead of ufw.
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "4.1.1"
    relation: looser
    note: Ours also accepts nftables, firewalld or iptables-persistent instead of ufw.
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "4.1.2"
    relation: looser
    note: Ours also accepts nftables, firewalld or iptables-persistent instead of ufw.
threats:
  - framework: mitre-attack
    id: T1046
  - framework: mitre-attack
    id: T1190
  - framework: cwe
    id: CWE-284
related_controls:
  - id: CB-UBU-NET-006
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot
    notes: "ufw installed but inactive on a fresh install, reported; fix allows port 22 and enables ufw; SSH by key of a non-root user accepted on localhost and port 22 reachable from the lab host after the fix and after reboot, other ports dropped. nftables alone passes; iptables-persistent next to ufw reported as a second firewall."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot
    notes: "ufw installed but inactive on a fresh install, reported; fix allows port 22 and enables ufw; SSH by key of a non-root user accepted on localhost and port 22 reachable from the lab host after the fix and after reboot, other ports dropped; second remediate leaves it alone."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot
    notes: "ufw inactive on a fresh install, reported; fix run before any SSH connection (no /run/sshd) still reads port 22 and enables ufw; SSH by key of a non-root user accepted on localhost and port 22 reachable from the lab host after the fix and after reboot, other ports dropped."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot
    notes: "ufw inactive on a fresh install, reported; fix allows port 22 and enables ufw; SSH by key of a non-root user accepted on localhost and port 22 reachable from the lab host after the fix and after reboot. ufw plus nftables.service reported and the fix refuses; after iptables-persistent removed ufw, the fix reinstalled it with apt."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19