/config/ufw/default-forward-policy
ufw DEFAULT_FORWARD_POLICY: allow routed traffic for VPNs, Docker and routers
- tool
- ufw
- file
- /etc/default/ufw
- key
- DEFAULT_FORWARD_POLICY
- type
- "DROP" | "ACCEPT" | "REJECT"
- default
- "DROP"
DEFAULT_FORWARD_POLICY in /etc/default/ufw sets what ufw does with packets that pass through the machine (routed from one interface to another), as opposed to packets addressed to it. The default "DROP" blocks all forwarding, which breaks a WireGuard or OpenVPN server that gives clients internet access, a LAN router and some container setups. Either set it to "ACCEPT", or keep "DROP" and allow only the routes you need with ufw route allow. Kernel forwarding (net.ipv4.ip_forward=1) must also be enabled.
Values
| Value | Command-line equivalent | Effect on routed packets |
|---|---|---|
| "DROP" (default) | ufw default deny routed | Discarded silently unless a ufw route rule allows them. |
| "REJECT" | ufw default reject routed | Refused with an ICMP error, so the sender fails fast instead of timing out. |
| "ACCEPT" | ufw default allow routed | Forwarded unless a route deny rule matches. |
The setting affects only the filtering of routed packets. It does not turn on routing in the kernel and it does not add NAT; both are separate steps described below. Packets addressed to the machine itself follow the incoming policy and the ufw allow rules instead.
Check the current state
sudo ufw status verbose prints a line such as Default: deny (incoming), allow (outgoing), disabled (routed). disabled (routed) means kernel forwarding is off, so nothing is routed whatever the policy says; once forwarding is on, the same position shows deny, reject or allow.
Option 1: targeted route rules (keeps DROP)
sudo ufw route allow in on wg0 out on eth0 # VPN clients to the internet
sudo ufw route allow in on eth1 out on eth0 from 192.168.10.0/24
sudo ufw status verbose # shows "routed" policy and route rulesOption 2: accept all forwarding
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw reloadsudo ufw default allow routed has the same effect from the command line.
Kernel forwarding
ufw's own copy of the kernel settings is /etc/ufw/sysctl.conf; uncomment the forwarding lines there (or set them in /etc/sysctl.d/):
net/ipv4/ip_forward=1
net/ipv6/conf/default/forwarding=1
net/ipv6/conf/all/forwarding=1Then sudo ufw reload. Check with sysctl net.ipv4.ip_forward.
NAT for VPN clients
Forwarding alone lets packets through; to give VPN clients the server's public address, add masquerading at the top of /etc/ufw/before.rules, before the *filter section:
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMITReplace 10.8.0.0/24 with the VPN subnet and eth0 with the internet-facing interface, then sudo ufw reload.
For the VPN side of this setup, the server's peer entries must list each client's tunnel address; see WireGuard AllowedIPs.
FAQ
Do I need DEFAULT_FORWARD_POLICY for a WireGuard client?
No. A client only sends its own traffic into the tunnel, which is outgoing traffic. The forward policy matters on the machine that routes other hosts' packets, such as the VPN server or a LAN gateway.
Is ufw default allow routed the same as editing /etc/default/ufw?
Yes. ufw default allow routed writes DEFAULT_FORWARD_POLICY="ACCEPT" into /etc/default/ufw and reloads the rules, so both ways give the same result.
Why does forwarding still fail after setting ACCEPT?
Check three things in order: kernel forwarding (sysctl net.ipv4.ip_forward must print 1), NAT for clients with private addresses, and the return route on the destination network. The ufw policy is only one of the conditions.