Lets assume:

• I have little or no knowledge of the inner workings of the Ubuntu/Linux OS, all I know is from my experience of Windows, is that I have to have a firewall configured and running before I connect to the internet, otherwise my system would be about as secure as going on hoiday and leaving my house with all the doors and windows open.


• I have just migrated to Ubuntu 18.04 LTS "desktop" and have just logged in for the first time, I want to secure my system before I connect my pc to the internet and after some research on this subject I understand this much:

(NB: Note the emphasis on the word desktop, so any references to server will not be pertinent to the question and therefore irrelevant)

a. ufw is the default firewall "configuration tool" for Ubuntu? (note it says configuration tool and not the actual firewall) and ufw is installed, but is not running and is not configured at all, so it has no default rules set out of the box.

b. Gufw is a UI to ufw, but its not installed by default, at least that is the case with Ubuntu Desktop 18.04 LTS.

c. iptables is the actual firewall which is built-in to the kernel as a module.

At this point know I can configure ufw as its easy as abc, hence its name and to use it you only need to set deny (incoming), allow (outgoing), and start it and I also understand I could use Gufw to do this too. So I could just leave it there and do just that.

However, after all my research, I find many articles, questions and blogs on the subject consisting of what appears to be mainly views and opinion based, then things start becoming unclear and ambiguous, so I digest all that information and try to make sense of it then reduce it down to a single statement and put into my own words and so a nutshell:

"Ubuntu desktop users dont need ufw since its merely a configuration tool for iptables which is the actual firewall under the hood."

So say I take the above statement literally, then is the following statement true?:

"iptables is the built in firewall for Ubuntu Desktop and is fully configured and up and running out of the box with default rules that are sufficiently secure for the average desktop user namely deny (incoming), allow (outgoing)."

Because if the above is true then what would be the point in ufw except to provide an uncomplicated interface to iptables, which by all accounts is complicated and furthermore the experts advise you to avoid configuring iptables directly since if you dont know exactly what you are doing, you could easily render your system insecure or unusable, if it is misconfigured?

Please could someone provide a concise relevant and a non-opinion fact based answer :)

Average home users don't need a firewall

Default Ubuntu desktop installation has no ports open, and no servers running. Therefore if you don't run any server daemon, such as ssh server, you don't need any firewall. Thus, iptable is configured to do nothing when you install Ubuntu. See Do I need to activate the firewall? I only use Ubuntu for a home desktop use? for details.

If you run servers you need a firewall

If you are not an average home user, and want to do some advanced things, such as remotely access your desktop by ssh or run some other services, then you need a firewall. Your configuration of the firewall will depend on which server daemons you plan to run.

Even if you don't plan to run a server you may want a firewall with the default configuration of deny all incoming connections from all ports. This is to be doubly safe, in case, one day you want to install and run a server without realizing what you are doing. Without changing the default firewall configuration the server won't work as expected. You will scratch your head for hours before remembering that you activated the firewall. Then you may want to uninstall the server software, as it may not be worth the risk. Or you may want to configure the firewall to let the server work.

gufw is the easiest

gufw is a GUI interface for ufw, which in turn configures the iptables. Since you have been using Linux since 1990s, you may be comfortable with the command line or you may prefer the visual cues of a GUI. If you like a GUI, then use gufw. It is easy to understand and configure even for a novice.

ufw is easy

If you like the command line, ufw is easy enough.

iptables is not so easy

The reason we don't want anyone to fiddle directly with the iptables, and use ufw or gufw is because, it is very easy to mess up iptables and once you do, the system can break so badly that it may be unusable.

Hope this helps