ufw --dry-run: preview the iptables rules a ufw command would create
- tool
- ufw
- command
- ufw
- flag
- --dry-run
- default
- off (ufw applies the change immediately and saves it in its rule files)
sudo ufw --dry-run allow 8080/tcp shows what the command would do without changing anything: ufw prints the rules it would write to its rule files (in iptables-restore format, in chains such as ufw-user-input) and leaves the running firewall and the saved configuration untouched. The ufw manual describes the option as "don't modify anything, just show the changes". It works with nearly every subcommand: allow, deny, limit, delete, route, default, logging, reset, enable and disable.
Typical uses
sudo ufw --dry-run allow 8080/tcp # preview one rule
sudo ufw --dry-run allow from 203.0.113.0/24 to any port 5432 proto tcp
sudo ufw --dry-run delete allow 8080/tcp # what would be removed
sudo ufw --dry-run default deny incoming # policy change
sudo ufw --dry-run enable # full rule set before enablingThe output lists the rule lines with ufw's chain names, for example -A ufw-user-input -p tcp --dport 8080 -j ACCEPT, plus the IPv6 counterpart when IPv6 is enabled in /etc/default/ufw. That is the quickest way to learn how ufw translates its simple syntax into iptables matches, or to check that a complex rule (from, to, proto, app) means what you think before it is live.
Why preview before enabling
| Risk | What the dry run shows |
|---|---|
| Locking yourself out over SSH | Whether an allow rule for your SSH port exists before ufw enable |
| Wrong direction or interface | in/out and on INTERFACE translated into -i or -o matches |
| Rule duplicates | Whether ufw would skip an existing rule (it reports Skipping adding existing rule for real runs) |
| IPv6 forgotten | Whether a matching ip6tables rule is generated |
| Policy changes | The new default policies of the built-in chains |
Related options
| Command | Effect |
|---|---|
| ufw --dry-run COMMAND | Show the change, do nothing |
| ufw show added | List rules added with ufw allow/deny, in command form |
| ufw show raw | The complete running rule set as ufw sees it |
| ufw status verbose | Active rules plus default policies and logging level |
| ufw --force enable | Enable without the SSH confirmation prompt |
Pitfalls
- Root still needed. Even a dry run reads files only root may read; otherwise ufw stops with You need to be root to run this script.
- It is not a packet test. The dry run shows rules, not whether a given connection would pass; test real traffic afterwards.
- Rule numbers come later. To see where a rule ended up, use ufw status numbered.
The everyday rule syntax is on ufw allow a port and in the ufw cheat sheet.
FAQ
Does ufw --dry-run need root?
Usually yes. ufw reads its rule files under /etc/ufw and /lib/ufw, which are readable only by root on standard installations, so run it with sudo even though nothing is changed.
Can I dry-run ufw enable before locking myself out?
Yes, ufw --dry-run enable prints the rule set that enabling would load without activating it. Check that your SSH port is allowed in that output before running the real command.
Does --dry-run show the rules in iptables-save format?
It prints the ufw rule files as they would be written, which use the iptables-restore format with ufw's own chains such as ufw-user-input. They are not applied.