What it is
ufw, the Uncomplicated Firewall, is a front end to the Linux kernel’s packet filter. Instead of writing firewall rules by hand, you allow or deny ports and addresses with short commands like ufw allow 8080/tcp.
Why it’s here
- On from the start. A desktop shouldn’t accept connections it doesn’t expect.
- Readable rules.
sudo ufw statusshows what’s open in plain terms. - Docker-aware. ufw-docker, from the AUR, stops published container ports from bypassing it.
On CoreDesktop
CoreDesktop installs ufw from pacman and ufw-docker from the AUR, then turns the firewall on: incoming connections are blocked except SSH, mDNS, LocalSend and anything over Tailscale. The System page lists the rules and the commands to open a port, and audit shows every open port and who can reach it. update keeps both packages current.