Skip to content
Browse

/commands/ufw/ufw-reset-all-rules

sudo ufw reset: delete all ufw rules and start over

The commands on this page have not been executed by our verification runner yet.updated
tool
ufw
versions
ufw 0.36
os
linux

sudo ufw reset disables ufw and replaces its rules files with the versions shipped with the package, removing every rule you added. It asks for confirmation; sudo ufw --force reset skips the prompt for scripts. The old files are not deleted: each one is renamed with a timestamp suffix, and ufw prints a Backing up 'user.rules' to '/etc/ufw/user.rules.YYYYMMDD_HHMMSS' line for each.

bash
sudo ufw status numbered        # see what you are about to remove
sudo ufw reset                  # asks, then disables ufw and restores the default files
sudo ufw --force reset          # no prompt
ls /etc/ufw/*.rules.*           # the timestamped backups

What happens, step by step

  1. ufw prints Resetting all rules to installed defaults. Proceed with operation (y|n)?. Over SSH the prompt adds This may disrupt existing ssh connections.
  2. If the firewall is enabled, it is disabled first.
  3. For every .rules file ufw manages (such as user.rules, user6.rules, before.rules, after.rules and their IPv6 versions), ufw renames the current file to NAME.rules.YYYYMMDD_HHMMSS and copies the packaged default in its place.
  4. ufw stays disabled. Nothing is filtered until you run ufw enable again.

Because before.rules and after.rules are reset too, custom NAT or forwarding rules you placed there (for a VPN or a router) are gone after the reset, not only the rules you added with ufw allow.

Rebuild safely

bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH          # or: sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

Add the SSH rule before ufw enable on a remote machine. Then re-add the other rules, using the backup user.rules.* file as a list of what you had.

CommandEffect
ufw resetRemove all rules, restore the packaged rules files, disable ufw.
ufw --force resetSame without the confirmation prompt.
ufw disableStop filtering but keep every rule for the next enable.
ufw delete NUMRemove a single rule by its number from ufw status numbered.
ufw reloadRe-read the rules files after editing them by hand.

Errors

  • ERROR: You need to be root to run this script: add sudo. See You need to be root.
  • ERROR: '/etc/ufw/user.rules.20261023_101500' already exists. Aborting: two resets ran within the same second; wait and run it again.
  • ERROR: problem running ufw-init on the next ufw enable usually means a rules file you restored or edited is invalid. See problem running ufw-init.

FAQ

Does ufw reset delete my backups?

No. It renames each rules file it replaces with a timestamp suffix such as user.rules.20261023_101500 in the same directory, so the previous rules stay on disk. Old backups from earlier resets are not removed either.

Can I restore the rules after a reset?

Yes, by copying the timestamped backups back over the rules files in /etc/ufw (user.rules, user6.rules and the others it lists) and running ufw enable or ufw reload. Check the files first; they hold the rules exactly as they were before the reset.

Does ufw reset change /etc/default/ufw?

The reset code replaces the .rules files with the copies shipped with the package. Settings in /etc/default/ufw, such as IPV6 or DEFAULT_FORWARD_POLICY, are a separate file; review it after a reset if you changed it before.

Sources

Related pages

commands · ufwufw allow 22/tcp: open a port with ufwsudo ufw allow 22/tcp opens a port in the ufw firewall. Ranges, source-restricted rules, app profiles, deleting rules, and the Docker port publishing caveat.cheat sheets · ufwufw cheat sheet: enable, allow, deny, delete and route rulesufw cheat sheet: enable safely over SSH, set default policies, allow, deny, limit and delete rules, route rules, app profiles, logging and the Docker caveat.errors · ufwERROR: problem running ufw-initufw-init failed to load the rules with iptables-restore, often after an edit to before.rules. Read the lines after the error and test files with --test.config · ufwufw DEFAULT_FORWARD_POLICY: allow routed traffic for VPNs, Docker and routersDEFAULT_FORWARD_POLICY in /etc/default/ufw is DROP, which blocks routed traffic for VPN servers and routers. Use ufw route allow, enable ip_forward, add NAT.