ufwctl

Rust library for managing UFW firewall rules through the official ufw CLI.

Linux-only

This crate targets Linux exclusively because UFW (Uncomplicated Firewall) is a Linux-specific tool. The crate will fail to compile on non-Linux targets with a clear compile-time error.

No external dependencies

This library uses only the Rust standard library. No external crates are required.

UFW CLI wrapper

ufwctl wraps the ufw command-line tool via std::process::Command. It does not read or write /etc/ufw/* files directly. Every operation delegates to the ufw binary.

Why no install / uninstall?

Package management (apt, pacman, dnf, etc.) is distro-specific and outside the scope of a core firewall library. Use your system package manager to install or remove ufw itself.

Examples

Port rules

use ufwctl::Firewall;

let fw = Firewall::new();

// Allow TCP on port 22
fw.port(22).allow().tcp().apply()?;

// Deny UDP on port 8080
fw.port(8080).deny().udp().apply()?;

// Allow both TCP and UDP on port 5050
fw.port(5050).allow().both().apply()?;

// Delete a rule
fw.port(5050).delete().both().apply()?;

// Check status
let status = fw.port(22).status().tcp()?;

IPv4 rules

fw.ipv4("192.168.1.10")?.allow().both().apply()?;
fw.ipv4("192.168.1.10")?.deny().tcp().apply()?;
fw.ipv4("192.168.1.10")?.delete().both().apply()?;
let status = fw.ipv4("192.168.1.10")?.status().tcp()?;

IPv6 rules

fw.ipv6("::1")?.allow().both().apply()?;
fw.ipv6("::1")?.deny().tcp().apply()?;
let status = fw.ipv6("::1")?.status().tcp()?;

Delete is idempotent

delete().apply() returns Result<bool, UfwError>. It attempts every variant of the rule (allow/deny × tcp/udp × bare/proto form) and succeeds as long as at least one form actually deleted a rule.

let deleted = fw.port(22).delete().tcp().apply()?;

if deleted {
    println!("Rule was deleted");
} else {
    println!("Rule did not exist (nothing to delete)");
}

Ok(true) means at least one matching rule was found and removed. Ok(false) means no matching rule existed — safe to call repeatedly.

Error handling

use ufwctl::Firewall;

let fw = Firewall::new();

match fw.enable() {
    Ok(()) => println!("Firewall enabled"),
    Err(e) => eprintln!("Failed: {e}"),
}

Safety note

This library modifies firewall rules by running sudo ufw ... commands. Depending on your configuration, this may require root privileges or passwordless sudo for the ufw command. Use with caution in production environments.