iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use UFW as the policy manager and place any rules it cannot express in UFW’s own rule files. Add early rules to /etc/ufw/before.rules, late rules to /etc/ufw/after.rules, and IPv6 equivalents to before6.rules and after6.rules. These files use iptables-restore syntax, so every table must end with COMMIT. Reload UFW, then verify with sudo iptables -S or sudo ufw show raw; ufw status does not list rules inserted this way.
What “combining iptables and UFW” actually means
UFW is a front end and rule generator for the netfilter firewall. It creates chains such as ufw-before-input, ufw-user-input, ufw-user-limit and ufw-user-limit-accept, then connects those chains to the kernel’s built-in INPUT, FORWARD and OUTPUT chains. A command such as sudo ufw allow 22/tcp normally adds policy through UFW’s user chains rather than by putting a rule directly in INPUT.
Combining the two safely means leaving those generated chains under UFW’s control and supplying exceptional rules through the files UFW reads when it builds its ruleset. Do not edit ufw-user-input by hand: UFW can regenerate it, and your edit is not a durable configuration.
Which integration point should you use?
| Method | When it runs | Survives UFW reload | Shown by ufw status? |
Main concern |
|---|---|---|---|---|
/etc/ufw/before.rules |
Before rules created by ufw allow or ufw deny |
Yes, when kept in the file | No | An early accept or drop can take precedence over a later UFW rule. |
/etc/ufw/after.rules |
After UFW’s user rules | Yes, when kept in the file | No | It cannot override a terminating decision that already matched earlier. |
Direct iptables -A command |
Immediately, in the chain you specify | Not reliably; it is outside UFW’s managed files | No | It can disappear on reboot or conflict with a later UFW regeneration. |
ufw allow/ufw deny |
In UFW’s normal user-rule position | Yes | Yes | It is limited to policies UFW’s command interface can express. |
Use before.rules for prerequisites, exceptions and protection that must be evaluated first. Use after.rules for supplementary policy that should run only after ordinary UFW decisions. Because a terminating match ends processing for that packet, put narrow source, destination and port matches before broad rules.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Prepare a safe change
- Confirm which UFW files your distribution uses. Current Ubuntu Server documentation and the
ufw-frameworkman page describe the file order, but the man page commonly installed on older systems is pinned to Ubuntu 18.04 (Bionic), so check the target release. - Identify your management path. Keep an existing SSH connection open and have a provider console or local console available before changing a firewall.
- Record the administrator’s source addresses, the SSH port, the server’s interface names and whether IPv6 or forwarding is in use.
- Check whether another service restores rules at boot. Packages such as
iptables-persistentandnetfilter-persistentcan compete with UFW.
Back up the files
sudo cp -a /etc/ufw/before.rules /etc/ufw/before.rules.bak
sudo cp -a /etc/ufw/after.rules /etc/ufw/after.rules.bak
sudo cp -a /etc/ufw/before6.rules /etc/ufw/before6.rules.bak
sudo cp -a /etc/ufw/after6.rules /etc/ufw/after6.rules.bakIf a file does not exist on your release, do not create a replacement until you have checked how that release enables IPv6 and which files UFW loads.
Add custom filter rules to UFW’s files
Use the existing *filter section
Open the relevant file and locate its existing *filter section. Add rules before that section’s COMMIT line. Do not place a second *filter header inside the existing section, and do not remove chain declarations generated by UFW.
The following example allows TCP port 8443 only from one administrative network and rejects all other sources. Replace the documentation-only address with your real, restricted source and choose a port that your application actually uses:
# inside the existing *filter section in /etc/ufw/before.rules
-A ufw-before-input -p tcp -s 203.0.113.10 --dport 8443 -m conntrack --ctstate NEW -j ACCEPT
-A ufw-before-input -p tcp --dport 8443 -m conntrack --ctstate NEW -j DROP
# keep the file's existing final line
COMMITThe allow rule must precede the broader drop. If the broad rule came first, packets from the trusted source would never reach the allow rule. Apply the same principle to address ranges, interfaces, protocols and connection states. Preserve the established and related-traffic rules that UFW placed in the file unless you have a specific, tested reason to change them.
Rules that should run after UFW
For a post-policy rule, add an entry to the existing *filter section of /etc/ufw/after.rules, again before its COMMIT. This position is appropriate when a rule should not supersede a normal UFW allow or deny. It is not an override mechanism for a decision that already terminated in an earlier chain.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
# inside the existing *filter section in /etc/ufw/after.rules
-A ufw-after-input -p tcp --dport 9443 -s 198.51.100.0/24 -j ACCEPT
COMMITUse the chain that already exists in your file. Names and built-in rules can vary by UFW release; inspect the file rather than assuming that every release has an identical ufw-after-input definition.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Handle IPv6 separately
IPv4 rules in before.rules do not protect IPv6 traffic. Put equivalent IPv6 policy in /etc/ufw/before6.rules or /etc/ufw/after6.rules, using IPv6 addresses and the chains defined in those files. For example:
# inside the existing *filter section in /etc/ufw/before6.rules
-A ufw6-before-input -p tcp -s 2001:db8:1234::10 --dport 8443 -m conntrack --ctstate NEW -j ACCEPT
-A ufw6-before-input -p tcp --dport 8443 -m conntrack --ctstate NEW -j DROP
COMMITThe exact chain prefix in your file is authoritative. If IPv6 is enabled in UFW but you update only IPv4, the service may remain reachable over an address family you did not test.
Add NAT or forwarding rules correctly
Forwarded traffic
Forwarding is evaluated through UFW’s forwarding path, not only its input path. Ubuntu Server guidance recommends placing additional forwarding rules in the UFW before section, commonly the ufw-before-forward chain inside before.rules. Ensure that kernel forwarding and UFW’s forwarding policy are intentionally enabled; a rule in the file does not by itself make a host a router.
# example placement inside the existing *filter section
-A ufw-before-forward -s 10.0.0.0/24 -d 10.0.1.0/24 -j ACCEPT
COMMITUse your actual networks and add reciprocal or return-traffic rules only when your design requires them. Test both directions from a client on each network.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Masquerading and other NAT
NAT rules belong in a separate *nat table. Append that table after the existing *filter section has been committed, and give the NAT table its own COMMIT line:
# after the *filter section and its COMMIT in /etc/ufw/before.rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
COMMITReplace 10.0.0.0/24 and eth0 with the private network and egress interface on your server. A misspelled interface causes the restore to fail or the rule to match no traffic. After changing NAT, restart or reload UFW using the procedure for your release so the complete ruleset is restored.
Reload without locking yourself out
- Validate the edited files visually: every table starts with its table header, chain declarations remain intact, rules are in the intended chain, and each table ends in
COMMIT. - Leave your current SSH session open. From a second session, prepare a connection using the administrator source address and port you allowed.
- Apply the change. On systems where the release documents a reload operation, use
sudo ufw reload. The broadly compatible fallback described in Ubuntu guidance is:
sudo ufw disable
sudo ufw enableDisabling and enabling can briefly interrupt traffic and can expose a syntax error immediately, which is why a console or second session matters. If enabling reports an error, restore the backup, enable UFW again, and correct one change at a time.
Verify the rules in the kernel
Use more than one view. UFW’s summary is intentionally incomplete for custom rules.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sudo ufw status verbose
sudo ufw show raw
sudo iptables -S
sudo iptables -t nat -S
sudo ip6tables -Sufw status verboseshows rules created through UFW’s normal command interface and the active default policies.ufw show rawexposes the generated ruleset, including chains and custom entries that the short status omits.iptables -Sshows the IPv4 filter chains and their jump order. Use-t nat -Sfor NAT.ip6tables -Sconfirms whether the IPv6 counterpart was loaded.
Test from the relevant source networks, not only from the server itself. Check both an expected allow and an expected deny, and verify that forwarded or translated traffic reaches the intended destination.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Why direct iptables -A commands are a poor long-term mix
A command such as sudo iptables -A INPUT -p tcp --dport 8443 -j ACCEPT changes the live ruleset immediately, but the rule is outside UFW’s managed files. It may be lost at reboot, omitted when UFW regenerates its chains, or evaluated in an unexpected position relative to UFW’s jumps. It also will not appear in ufw status. Use a direct command for short-lived diagnosis or emergency recovery, then encode the final rule in the appropriate UFW file or with a supported ufw command.
Persistence, stopping UFW and version differences
Do not assume that stopping UFW removes every rule that came from its files. Launchpad bug 881137 records the issue that UFW does not necessarily clean iptables settings originating in /etc/ufw/before.rules. Ubuntu developers have indicated that built-in chains may be left in place because other software can use them. The exact behavior is release-dependent; systems that need explicit cleanup may use the MANAGE_BUILTINS setting or the before.init/after.init hooks documented for that release.
That behavior matters during incident response: after ufw disable, inspect the live chains instead of assuming the host is unfiltered. Conversely, do not add a second persistence service merely because a direct test rule disappeared. Decide which component owns restoration and remove duplicate saved rulesets.
Recommended Free Tools
Common conflicts and how to diagnose them
iptables-persistent or netfilter-persistent
Launchpad bug 1987227 describes UFW failing to enable when persistence packages are installed. A stale ruleset may be restored before UFW, leaving traffic blocked or producing a ruleset different from the files you edited. Check installed services and saved rules under the persistence package’s configuration, then choose one owner. After changing ownership, reboot or restart in a maintenance window and verify the resulting chains with iptables -S.
Docker and other software-managed chains
Container engines commonly install their own chains and may place forwarding or published-port rules ahead of UFW’s policy. A community recipe describes adding a DOCKER-USER jump to ufw-user-input, returning private ranges, and flushing those chains from an init hook. That is not an official, universally verified recipe: chain names, startup order and nftables compatibility vary between Docker and UFW releases. Treat it as a design to test on a disposable host, not as a copy-and-paste guarantee. Inspect the live FORWARD, DOCKER-USER and UFW chains and define which component owns published ports before enforcing a production rule.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
iptables-nft versus legacy iptables
On newer distributions, the iptables command can be a compatibility layer over nftables. The output of iptables -S, rule counters and interaction with applications may therefore differ from an older, legacy-iptables host. The available documentation does not establish one behavior for every current distribution. Confirm the selected backend with your distribution’s tooling, avoid mixing native nftables rules with an unmanaged UFW configuration, and test the actual packet path.
Troubleshoot by symptom
The rule is absent after reload
- Confirm it was inserted before the correct
COMMITin the existing table. - Check that you edited
before6.rulesfor IPv6 traffic rather than only the IPv4 file. - Run
sudo ufw show rawandsudo iptables -Sto distinguish a parsing failure from a display limitation. - Look for another persistence service restoring a different ruleset after UFW loads.
The rule exists but has no effect
- Inspect jump order. A previous terminating accept or drop may win before your rule.
- Check that the packet is entering the chain you edited: input, forward and output are separate paths.
- Verify protocol, address family, interface and destination port; an IPv6 client will not match an IPv4 source rule.
- For NAT, inspect
sudo iptables -t nat -Sand confirm the egress interface and source network.
SSH stopped working
Keep the console or existing session open, restore the backup files, and re-enable UFW. Then add a narrowly scoped management allow rule before any broad drop, reload, and test from a second connection before closing the original session.
UFW will not enable
Read the enable error for the file and table it rejected. A missing COMMIT, malformed option, duplicate table header or incompatible address family is usually localized by the reported line. Restore the last known-good backup, enable UFW, and reapply changes incrementally. Also check for competing persistence packages.
A maintainable operating pattern
- Keep simple service exposure in
ufw allowandufw denyso operators can see it inufw status. - Reserve
before.rulesfor traffic that must precede normal policy, and document why each early rule needs that precedence. - Use
after.rulesfor non-overriding additions and for NAT blocks that UFW does not express through its command interface. - Mirror deliberate IPv4 policy in the IPv6 files when IPv6 is enabled.
- Keep dated backups and a short change record containing the source networks, interfaces, expected match order and rollback command.
- After every change, reload once, inspect raw and kernel views, and test an allow and a deny from an external host.
This arrangement lets UFW continue regenerating its own chains while your exceptional iptables behavior remains in files that are restored with the firewall. It also makes precedence, persistence and rollback visible to the next administrator instead of leaving undocumented commands in a shell history.
Bottom line
Combine the tools by assigning ownership: UFW manages its generated chains, while your custom iptables rules live in before.rules, after.rules and their IPv6 counterparts. Respect the before–user–after order, terminate each table with COMMIT, reload with a recovery path available, and verify the live rules with iptables commands rather than relying on ufw status.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
