I am trying to find out the difference what ubuntu firewall is doing.

First I disabled the firewall, using sudo ufw disable and run nmap scan over localhost sudo nmap I got the result

Starting Nmap 6.40 ( http://nmap.org ) at 2016-10-09 14:48 IST
Nmap scan report for localhost (
Host is up (0.000016s latency).
Not shown: 997 closed ports
80/tcp   open  http
631/tcp  open  ipp
3306/tcp open  mysql

After enabling firewall, I run nmap, and got same result. So what is the difference ?

  • What does sudo ufw status verbose return?
    – A. Darwin
    Oct 9, 2016 at 9:41
  • Status:active Logging:on (low) Default:deny (incoming), allow (outgoing), disabled (routed) New profiles:skip
    – Tarun
    Oct 9, 2016 at 9:45

1 Answer 1


After enabling firewall, I run nmap, and got same result. So what is the difference ?

Like you said, there is no difference. The reason is that the default configuration of UFW allows loopback traffic, i.e. traffic involving

You can do everything with ufw that iptables can do. You can add only simple rules using the command line. If you want to add more advance rules, then you can accomplish this by editing several ufw config files.

/etc/default/ufw : This is main ufw config file for default policy and kernel modules.

/etc/ufw/before.rules : Rules in these files are calculate before any rules added via the ufw command.

/etc/ufw/after.rules : Rules in these files are calculate after any rules added via the ufw command.

By default UFW allows DHCP, ping and loopback. You can disallow this by editing the before.rules file.

sudo nano /etc/ufw/before.rules


If you scanned your computer from another IP address, or if you edited the default rules, a Nmap scan would probably show nothing.

  • Just wondering, is there something like full scan in nmap, that scans for everything it can. So that I can see more differences while firewall is on and off.
    – Tarun
    Oct 9, 2016 at 10:52
  • You can use nmap -p- to scan all the 65,535 possible ports (while nmap by default only scans 1,000 ports). However, since your firewall allows that kind of traffic, your scan will be different from the scan of an attacker (which should be blocked by UFW). If you want to understand more about firewalls and Nmap scans, I suggest you to set up a Ubuntu virtual machine, enable the firewall and launch Nmap against that IP from another machine. In this way, you can (safely and legally) simulate the result that an attacker would get.
    – A. Darwin
    Oct 9, 2016 at 11:02
  • In this case it might not be necessary since you are running Nmap from the same network, but I would also add -Pn to the command of the previous comment to force Nmap to scan every port regardless. Dec 8, 2016 at 3:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .