ufw module

UfwApplications

The application profiles installed on the host.

Commands:

ufw app list 2> /dev/null || sudo -n ufw app list 2> /dev/null || true

Returns:

list[str]

Raises:

HostConnectionError

Examples:

Examples can be found in examples/modules/ufw/ufw_ufw_applications.py.

UfwRule

Attributes:

Name	Type	Description
number		The 1-based rule number (the [ N] column of ufw status numbered).
action		The verdict word (ALLOW, DENY, REJECT or LIMIT).
direction		The direction word (IN, OUT or FWD for a route rule).
log		Whether the rule logs (the trailing (log)/(log-all) attribute).
v6		Whether the row is the IPv6 family member (the (v6) marker on either column).
to_addr		The destination address/CIDR (Anywhere when the rule targets any address).
port		The destination port token (22, 80,443, 8000:8010); "" when the rule names no port.
protocol		The protocol suffix (tcp/udp); "" when the rule covers both.
app		The application profile name (Nginx Full); "" when the rule is not profile-based.
from_addr		The source address/CIDR (Anywhere when the rule accepts any source).
interface		The bound interface (the on <iface> suffix on either column); "" when unbound.
comment		The rule comment (the trailing # ... text); "" when uncommented.

UfwRules

The ufw ruleset as numbered, structured rule entries.

Commands:

ufw status numbered 2> /dev/null || sudo -n ufw status numbered 2> /dev/null || true

Returns:

list[UfwRule]

Raises:

HostConnectionError

Examples:

Examples can be found in examples/modules/ufw/ufw_ufw_rules.py.

UfwStatus

Whether ufw is active, its logging level and its default policies.

Commands:

ufw status verbose 2> /dev/null || sudo -n ufw status verbose 2> /dev/null || true

Returns:

UfwStatusInfo

Raises:

HostConnectionError

Examples:

Examples can be found in examples/modules/ufw/ufw_ufw_status.py.

UfwStatusInfo

Attributes:

Name	Type	Description
active		Whether ufw status verbose reported Status: active; False for an inactive firewall, a missing binary or an unprivileged read.
logging		The logging level word (off, low, medium, high, full or unknown when ufw cannot read its loglevel); "" when inactive or unreadable.
default_incoming		The default incoming policy (deny, allow or reject); "" when inactive or unreadable.
default_outgoing		The default outgoing policy; "" when inactive or unreadable.
default_routed		The default routed (forwarded) policy (disabled, deny, allow or reject); "" when inactive or unreadable.

default_policy async

default_policy(
    ctx: OpContext,
    direction: str = "incoming",
    policy: str = "deny",
    **kwargs: Any,
) -> AsyncGenerator[Command]

Set the default policy for incoming, outgoing or routed traffic.

Parameters:

Name	Type	Description	Default
ctx	OpContext	Execution context for the operation.	required
direction	str	Which default policy to manage: incoming, outgoing or routed. Defaults to "incoming".	'incoming'
policy	str	The fallback verdict: allow, deny or reject. Defaults to "deny".	'deny'
**kwargs	Any	Additional keyword arguments.	{}

Yields:

Name	Type	Description
Command	AsyncGenerator[Command]	Generated ufw default-policy commands.

Raises:

HostConnectionError, ValueError

Examples:

Examples can be found in examples/modules/ufw/ufw_default_policy.py.

logging async

logging(
    ctx: OpContext, level: str = "low", **kwargs: Any
) -> AsyncGenerator[Command]

Set the ufw logging level.

Parameters:

Name	Type	Description	Default
ctx	OpContext	Execution context for the operation.	required
level	str	The logging level: off, on, low, medium, high or full. on enables logging at the current level (low when currently off), mirroring ufw's own semantics. Defaults to "low".	'low'
**kwargs	Any	Additional keyword arguments.	{}

Yields:

Name	Type	Description
Command	AsyncGenerator[Command]	Generated ufw logging commands.

Raises:

HostConnectionError, ValueError

Examples:

Examples can be found in examples/modules/ufw/ufw_logging.py.

reset async

reset(
    ctx: OpContext, **kwargs: Any
) -> AsyncGenerator[Command]

Reset ufw to installation defaults, deleting every rule.

Parameters:

Name	Type	Description	Default
ctx	OpContext	Execution context for the operation.	required
**kwargs	Any	Additional keyword arguments.	{}

Yields:

Name	Type	Description
Command	AsyncGenerator[Command]	The reset command, always (the operation is stateless).

Raises:

None

Examples:

Examples can be found in examples/modules/ufw/ufw_reset.py.

rule async

rule(
    ctx: OpContext,
    port: int | str | tuple[int | str, ...] | None = None,
    protocol: str | None = None,
    action: str = "allow",
    present: bool = True,
    direction: str = "in",
    route: bool = False,
    from_ip: str | None = None,
    to_ip: str | None = None,
    app: str | None = None,
    interface: str | None = None,
    log: bool = False,
    comment: str | None = None,
    insert: int | None = None,
    **kwargs: Any,
) -> AsyncGenerator[Command]

Add or remove a ufw rule (ports, profiles, addresses, routes).

Parameters:

Name	Type	Description	Default
ctx	OpContext	Execution context for the operation.	required
port	int | str | tuple[int | str, ...] | None	The destination port: a single port (22), a colon range ("8000:8010") or a tuple multiport ((80, 443)). Multiports and ranges require protocol. Defaults to None.	None
protocol	str | None	The protocol, tcp or udp; None covers both. Defaults to None.	None
action	str	The verdict: allow, deny, reject or limit (rate limiting). Defaults to "allow".	'allow'
present	bool	Whether the rule should exist. Defaults to True.	True
direction	str	Traffic direction, in or out. Defaults to "in".	'in'
route	bool	Whether this is a routed (forwarded) traffic rule (ufw route ...). Defaults to False.	False
from_ip	str | None	Source address/CIDR restriction; None means any source. Defaults to None.	None
to_ip	str | None	Destination address/CIDR restriction; None means any destination. Defaults to None.	None
app	str | None	An application profile name (e.g. "Nginx Full") instead of a port; mutually exclusive with port and protocol. Defaults to None.	None
interface	str | None	Bind the rule to an interface (the incoming interface for in/route rules, the outgoing one for out rules). Defaults to None.	None
log	bool	Whether matched packets are logged. Defaults to False.	False
comment	str | None	Rule comment -- the reliable auditing marker, shown by ufw status. Defaults to None.	None
insert	int | None	The 1-based position to insert a new rule at; an existing rule is never repositioned, and deletion ignores it. Defaults to None.	None
**kwargs	Any	Additional keyword arguments.	{}

Yields:

Name	Type	Description
Command	AsyncGenerator[Command]	Generated ufw rule commands.

Raises:

HostConnectionError, ValueError

Examples:

Examples can be found in examples/modules/ufw/ufw_rule.py.

state async

state(
    ctx: OpContext, enabled: bool = True, **kwargs: Any
) -> AsyncGenerator[Command]

Ensure the ufw firewall is enabled or disabled.

Parameters:

Name	Type	Description	Default
ctx	OpContext	Execution context for the operation.	required
enabled	bool	Whether the firewall should be active (and start on boot). Defaults to True.	True
**kwargs	Any	Additional keyword arguments.	{}

Yields:

Name	Type	Description
Command	AsyncGenerator[Command]	Generated ufw state commands.

Raises:

HostConnectionError

Examples:

Examples can be found in examples/modules/ufw/ufw_state.py.