/errors/ufw/problem-running-ufw-init
ERROR: problem running ufw-init
- tool
- ufw
- exit code
- 1
- versions
- ufw 0.36, ufw 0.36.2
- os
- linux
ERROR: problem running ufw-init means ufw started its helper script ufw-init, which loads the rule files with iptables-restore, and the script failed. ufw adds the helper's output right after this line, and that output names the real problem: usually a syntax error in /etc/ufw/before.rules or another rules file after a manual edit, or a rule the kernel cannot load. Read the lines after the message, test the files with iptables-restore --test, and fix the line it reports.
Where the message comes from
In ufw's src/backend_iptables.py, start_firewall() and stop_firewall() run ufw-init start or ufw-init force-stop; when the exit code is not zero they raise problem running ufw-init followed by a newline and the script's output. ufw prints errors as ERROR: MESSAGE and exits with status 1. Typical follow-up lines come from iptables-restore, for example iptables-restore: line N failed, which points into one of the rule files.
Test the rule files
iptables-restore --test < /etc/ufw/before.rules
iptables-restore --test < /etc/ufw/after.rules
ip6tables-restore --test < /etc/ufw/before6.rules
ip6tables-restore --test < /etc/ufw/after6.rulesRun them as root. --test parses and checks the rules without applying them. The ufw files reference ufw's own chains (ufw-before-input and others), so a file tested alone may also complain that a chain does not exist; the line that fails for another reason is the one to fix.
| Common mistake in before.rules | Fix |
|---|---|
| A rule added after the final COMMIT line | Move it above COMMIT, inside the *filter section |
| A *nat section added without its own COMMIT | End every *table section with COMMIT |
| A NAT rule placed in the *filter section | Put it in a *nat section at the top of the file |
| A module that the kernel lacks (for example -m conntrack in a minimal container) | Load the module on the host, or remove the rule |
Containers and IPv6
In LXC or Docker containers ufw often cannot load modules or change the host's tables; run the firewall on the host instead. On systems with IPv6 disabled in the kernel, IPV6=yes in /etc/default/ufw can make the IPv6 part fail; set IPV6=no, then ufw disable and ufw enable.