ufw and firewalld, with every change previewed before it runs
A terminal UI for the Linux firewall, driving ufw and firewalld. It shows the rules you actually have — action, ports, source, destination, services, rich rules, IPv6 and forwarding included — alongside the default policies or zone targets and the logging level.
The UI never builds a command line. It talks to a backend behind an interface, which returns a firewall-neutral model and produces command values; the confirm dialog shows those values and hands the same ones to the runner, so what you read is what executes. On firewalld that means both lines: the change to the running firewall and the same change made permanent, with no reload and no dropped connections.
Run tui-firewall --demo for an in-memory ufw, or tui-firewall --demo=firewalld for an in-memory firewalld: every key works, every command is built and previewed for real, and nothing touches your system.
| Key | Action |
|---|---|
| a | Add a rule |
| d | Delete the selected rule |
| e | Enable or disable the firewall (ufw) |
| p | Change a default policy, or a firewalld zone target |
| L | Change the logging level, or the firewalld log-denied value |
| r | Reload the firewall |
| x | Actions this backend offers beyond these keys |
| / | Filter rules across every column |
| [ / ] | Previous / next group: the firewalld zones and policies |
| R | Re-read the firewall |
| ? | Help |
| q | Quit |
Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.
This tool is a face on the program below, so its version matters.Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as(untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.
ufw0.36ufw --versionrule-commentssince 0.35ufw <0.36ufw status numbered has no app profile column, so a rule added from a profile is shown by its ports and cannot be edited as a profile
ufw 0.36.xstatus numbered indexes IPv4 and IPv6 halves of one rule separately, so deleting by number renumbers the rest and the list is re-read after every delete
firewall-cmd0.9firewall-cmd --versionfirewalld ==2.0.0--permanent --list-all-zones prints the same settings for every zone on this release (firewalld#1152), so the permanent half of the runtime/permanent comparison is not trustworthy; 2.0.1 fixed it
firewalld >=2.2firewalld removed the lockdown feature, so no lockdown state is shown
Once per machine, then every tool in the family is one pacman away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
sudo pacman-key --add /tmp/tui-tools.asc
sudo pacman-key --lsign-key \
"$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
| sudo tee -a /etc/pacman.conf
sudo pacman -Sy$ sudo pacman -S tui-firewallUpgrades then arrive with the rest of your system updates.
$ paru -S tui-firewall-binThe -bin package installs the released static binary.
Once per machine, then every tool in the family is one apt away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://pkgs.tui.tools/pubkey.asc \
| sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
| sudo tee /etc/apt/sources.list.d/tui-tools.list
sudo apt update$ sudo apt install tui-firewallUpgrades then arrive with the rest of your system updates.
Once per machine, then every tool in the family is one dnf away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo rpm --import https://pkgs.tui.tools/pubkey.asc
sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
sudo dnf makecache$ sudo dnf install tui-firewallUpgrades then arrive with the rest of your system updates.
Needs the tui-tools repository, a one-time setup you do once per machine.
$ sudo zypper install tui-firewallThe rpm repository is shared with dnf; zypper support is not tested yet.
$ curl -fsSL https://github.com/tui-tools/tui-firewall/releases/download/v0.2.1/tui-firewall_0.2.1_linux_amd64.tar.gz | tar -xz tui-firewall
sudo install -m0755 tui-firewall /usr/local/bin/tui-firewall$ curl -fsSL https://github.com/tui-tools/tui-firewall/releases/download/v0.2.1/tui-firewall_0.2.1_linux_arm64.tar.gz | tar -xz tui-firewall
sudo install -m0755 tui-firewall /usr/local/bin/tui-firewallOne static binary. Verify it against checksums.txt from the same release.
$ git clone https://github.com/tui-tools/tui-firewall
cd tui-firewall && make build
sudo install -m0755 bin/tui-firewall /usr/local/bin/tui-firewallNeeds Go 1.26 or newer.
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
Reading the firewall and every change need root: ufw status and its add/delete/enable/reload/policy/logging, and every firewall-cmd read and write. Escalation goes through sudo -n, which never prompts; --sudo "" runs the command directly when you are already root.
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
The tool opens no network connection of its own. No telemetry, no update check, no phone home.
Released statically linked, with no runtime dependencies to install.
Releases carry SHA-256 checksums but no signature. Verify the checksum, and read this as the open item it is.
Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.
| File | Size | SHA-256 |
|---|---|---|
| checksums.txt | 808 B | — |
| tui-firewall-0.2.1-1-aarch64.pkg.tar.zst | 1.7 MB | e06b47acea7552a1ec6116f94bbbfc41efa30e883d1adc2927090ea1ba8fa089 |
| tui-firewall-0.2.1-1-x86_64.pkg.tar.zst | 1.9 MB | e4237fb9f0ae259e151f81c6448da28319a6cde0f4825cb67c38d46041e9681c |
| tui-firewall-0.2.1-1.aarch64.rpm | 1.7 MB | f3e365b1b041a66efc300202d4417ba2fd420139f28ab001d18f359a95c495fa |
| tui-firewall-0.2.1-1.x86_64.rpm | 1.9 MB | 5a5052935b3b785211b4d8213c57fa81913d2a6e5c33cea2372e240736183484 |
| tui-firewall_0.2.1_amd64.deb | 1.9 MB | 680382b242a39b70dd55a100b2177067ceccaa837933d52499a22e8f5905e44d |
| tui-firewall_0.2.1_arm64.deb | 1.7 MB | 69fead17e64915384af446c7aa2fa1ee35fe60f40cc069ef1f8407c5bd7e91df |
| tui-firewall_0.2.1_linux_amd64.tar.gz | 1.9 MB | a50fd12e43a68bc0897660191fa7dfdd64d632ba18cbfded7d1227ebfd1d1b54 |
| tui-firewall_0.2.1_linux_arm64.tar.gz | 1.7 MB | 480c14921de88036c729a9affc93634e47fc9a23013b49b1d83c5e3cb7333216 |
Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.
## Changelog * 4062d6971a9e859a8be3c2c6482541d922e685ef Ship the tool as a .deb, an .rpm and a pacman package
## Changelog * 207f07781735090534fcfefc2ed7a06a9066fe9d Add --check, a non-interactive read path, and a backend smoke test * 2f750800d0ddd6aaa7f030f90b7ab94ade7d3424 Add tool.json and generate the README Install section from it * c48b5087567f49c363aa218b8a0d5056bdef163d Assert real firewalld behaviour in the lab, not a stub * fe0eab2a5a1e383c75a02412264451bd5b6ffc29 Bump the github-actions group with 5 updates (#1) * a041d686c727f2131875c495967d02f958b87450 Document firewalld, and screenshot it * 8a08d6e8a0edd23c19ecd39b52b58e9e2b5554da Drive firewalld for real, behind the same backend interface * a2f36e0bf3049795539f3f94446d8bd69c1d38cc Hold both ends of the tested firewalld range * 745e37130fab6b1576310b1974afe09797da5827 Hold this tool to the family's lint bar * 2e081b07e7a2d078eae6952e4078b3b007460f0b Keep the sudo note inside the manifest's length limit * 2fa4c9aa63b2b9d28510117c5d04c54d7fc3a72c Re-pin the kit at v0.1.3 for the help panel width fix * e46dccea33b8b8e70eb22637c0a6771dcfb9b3d2 Re-pin the kit at v0.2.3 * 615bf4454c3fbd7d807acaa2de0c6e7823ac6ab3 Separate deciding which firewall to drive from reaching for it * 34abbdb3baf3d43283c99461ec10c6b7d44ab6f4 Show which ufw version is being driven * 7ed706447b61f79992a17fdcc95648be2c53e7cf Test the firewalld backend against captured firewall-cmd output
## Changelog * fba69433282c466da095ed7bca42e77b0909815b Add fwall v0.1, a TUI for the system firewall * 806e85f02d850aa1dbc6dd1378fafb3a5ceed9ab Add the backend-agnostic firewall model and backend selection * 0ea1fda195d90c82547712bd856ed6cbe4f0865f Become tui-firewall, a repository of its own * 71847bc95a88cbde146e0a86e93217ac6d8c6b2c Depend on tui-kit v0.1.1 for the table layout fix * 3e7ee4cae39f30c171f635216e5619f37bae0271 Implement the ufw backend with parsers and a fake * f10888e19b97ab5a1846b58c29830a60376c3173 README: unofficial, under-validation disclaimer * 1abc40bbe47f9823d6bfcf5c0c15cf4c5bbe1625 Scaffold the tui-tools monorepo