---
title: Install ufw Package
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Install ufw Package
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Install ufw Package
 
## Description{% #description %}

The `ufw` package can be installed with the following command:

```
$ apt-get install ufw
```

## Rationale{% #rationale %}

`ufw` controls the Linux kernel network packet filtering code. `ufw` allows system operators to set up firewalls and IP masquerading, etc.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$' && { ( { { dpkg-query --show --showformat='${db:Status-Status}' 'ufw' 2>/dev/null | grep -q '^installed$' && grep -Eqs '^[[:blank:]]*ENABLED="?(yes|YES)"?[[:blank:]]*$' /etc/ufw/ufw.conf && systemctl is-enabled ufw.service 2>/dev/null | grep -q '^enabled'; } || ! { { dpkg-query --show --showformat='${db:Status-Status}' 'nftables' 2>/dev/null | grep -q '^installed$' && systemctl is-enabled nftables.service 2>/dev/null | grep -q '^enabled'; } || dpkg-query --show --showformat='${db:Status-Status}' 'iptables-persistent' 2>/dev/null | grep -q '^installed$'; }; } ); }; then

var_network_filtering_service='ufw'



  if [[ "ufw" =~ $var_network_filtering_service ]]; then
    DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 install -y "ufw"
  fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```gdscript3
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-UBTU-22-251010
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_ufw_installed

- name: Gather the service facts
  ansible.builtin.service_facts: null
  tags:
  - DISA-STIG-UBTU-22-251010
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_ufw_installed
- name: XCCDF Value var_network_filtering_service # promote to variable
  set_fact:
    var_network_filtering_service: !!str ufw
  tags:
    - always

- name: Ensure ufw is installed
  ansible.builtin.package:
    name: ufw
    state: present
  when:
  - '"linux-base" in ansible_facts.packages'
  - (("ufw" in ansible_facts.packages and (((ansible_facts.services | default({}))["ufw.service"]
    | default({})).status | default("")) in ["enabled", "enabled-runtime"]) or not
    (("nftables" in ansible_facts.packages and (((ansible_facts.services | default({}))["nftables.service"]
    | default({})).status | default("")) in ["enabled", "enabled-runtime"]) or "iptables-persistent"
    in ansible_facts.packages))
  - var_network_filtering_service is regex("ufw")
  tags:
  - DISA-STIG-UBTU-22-251010
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_ufw_installed
```