💡 Why?

UFW is already "uncomplicated" — but fw makes it human:

• Service names instead of port numbers (ssh not 22)
• Named groups for IP ranges (cloudflare, office)
• Comma-separated ports in one command (http,https)
• Interactive mode for guided rule creation
• Doctor diagnostics to find problems
• Beautiful status with colors and rule numbers

📦 Installation

Requirements: Debian/Ubuntu with UFW. Optionally jq for group management (auto-installed).

Quick Install (recommended)

git clone https://github.com/jindrichstoklasa/firewall-for-humans.git
cd firewall-for-humans
sudo bash install.sh

Manual Install

git clone https://github.com/jindrichstoklasa/firewall-for-humans.git
cd firewall-for-humans
chmod +x fw
sudo cp fw /usr/local/bin/fw

Uninstall

sudo bash uninstall.sh

🚀 Usage

fw <command> [arguments]
sudo fw <command> [arguments]   # commands that modify rules require root

Most commands require sudo (allow, deny, limit, on, off, reset). Read-only commands like status, services, and help work without it.

Run fw help to see all available commands and options.

⚡ Quick Start

| Command | Description | |---------|-------------| | sudo fw on | Enable the firewall | | sudo fw allow ssh | Allow SSH (don't lock yourself out!) | | sudo fw allow http,https | Allow web traffic | | sudo fw limit ssh | Rate-limit SSH to prevent brute force | | fw status | Check firewall status |

📋 Commands

🖥️ Basic Rules

fw allow <port|service> [tcp|udp] [from <ip|group>] [comment <text>]
fw deny <port|service> [tcp|udp] [from <ip|group>] [comment <text>]
fw reject <port|service> [tcp|udp] [from <ip>]
fw limit <port|service> [tcp|udp]
fw remove <rule_number>
fw remove <allow|deny> <port|service>

🏷️ Service Names

Use human-readable service names anywhere you'd use a port number:

| Command | Port | |---------|-------------| | fw allow ssh | 22 | | fw allow http,https | 80,443 | | fw deny ftp | 21 | | fw allow mysql | 3306 | | fw allow postgres | 5432 | | fw allow redis | 6379 | | fw allow mongodb | 27017 |

100+ built-in services — see them all:

fw services              # list all
fw services redis        # filter by name

Categories: Web, SSH, FTP, Email, DNS, Databases, Message Queues, Monitoring, CI/CD, Containers, VPN, Remote Desktop, and more.

👥 Named Groups

Group IP ranges under memorable names:

# Create groups
fw group create office 192.168.1.0/24 10.0.0.0/24
fw group create cloudflare 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22

# Use in rules
fw allow 443 from cloudflare
fw allow mysql from office

# Manage groups
fw group list
fw group show office
fw group add office 172.16.0.0/16
fw group remove office 10.0.0.0/24
fw group delete old-group

Groups are stored in ~/.config/fw/groups.json.

⚙️ Management

| Command | Description | |---------|-------------| | fw status | Pretty status table with rule numbers | | fw on | Enable firewall | | fw off | Disable firewall | | fw reset | Reset all rules (with confirmation) |

🧭 Interactive Mode

Don't remember the syntax? Let fw guide you:

fw add

Walks you through: Action → Port/Service → Protocol → Source → Comment → Confirm.

🔧 Advanced

# Test if a connection would pass
fw test 192.168.1.50 443
fw test 10.0.0.1 ssh

# View logs
fw log                      # Recent entries
fw log blocked              # Only blocked
fw log blocked --last 1h    # Last hour

# Export / Import rules
fw export                    # → fw-rules.json
fw export backup.json
fw import backup.json

# Compare with remote server
fw diff user@production-server

# Diagnose issues
fw doctor

🩺 Doctor

fw doctor checks for:

• ✗ Firewall inactive
• ✗ Default incoming policy set to allow
• ! Duplicate rules
• ! SSH open to anywhere (not limited)
• ! Listening ports without firewall rules
• ! Logging disabled

⌨️ Tab Completion

Bash and Zsh completions are installed automatically. Supports:

• Command names
• Service names
• Protocol names (tcp/udp)
• Group names (from your groups.json)

📁 File Structure

~/.config/fw/
  └── groups.json      # Named IP groups
/usr/local/bin/fw      # Main script
/etc/bash_completion.d/fw  # Bash completions

💻 Compatibility

| Distribution | Version | Status | |-------------|---------|--------| | Ubuntu | 20.04+ | ✅ Fully supported | | Ubuntu | 22.04+ | ✅ Fully supported | | Ubuntu | 24.04+ | ✅ Fully supported | | Debian | 11 (Bullseye) | ✅ Fully supported | | Debian | 12 (Bookworm) | ✅ Fully supported |

📄 License

This project is licensed under the MIT License — see the LICENSE file for details.