Firewall for Humans

Human-Friendly Firewall CLI Tool
Commands you can read like English sentences. No flags, no manual.

💡 Why?

UFW is already "uncomplicated" — but fw makes it human:

• Service names instead of port numbers (ssh not 22)
• Named groups for IP ranges (cloudflare, office)
• Comma-separated ports in one command (http,https)
• Interactive mode for guided rule creation
• Doctor diagnostics to find problems
• Beautiful status with colors and rule numbers

📦 Installation

Requirements: Debian/Ubuntu with UFW. Optionally jq for group management (auto-installed).

Quick Install (recommended)

git clone https://github.com/jindrichstoklasa/firewall-for-humans.git
cd firewall-for-humans
sudo bash install.sh

Manual Install

git clone https://github.com/jindrichstoklasa/firewall-for-humans.git
cd firewall-for-humans
chmod +x fw
sudo cp fw /usr/local/bin/fw

Uninstall

sudo bash uninstall.sh

---

🚀 Usage

fw <command> [arguments]
sudo fw <command> [arguments]   # commands that modify rules require root

Most commands require sudo (allow, deny, limit, on, off, reset). Read-only commands like status, services, and help work without it.

Run fw help to see all available commands and options.

⚡ Quick Start

Command	Description
sudo fw on	Enable the firewall
sudo fw allow ssh	Allow SSH (don't lock yourself out!)
sudo fw allow http,https	Allow web traffic
sudo fw limit ssh	Rate-limit SSH to prevent brute force
fw status	Check firewall status

📋 Commands

🖥️ Basic Rules

fw allow <port|service> [tcp|udp] [from <ip|group>] [comment <text>]
fw deny <port|service> [tcp|udp] [from <ip|group>] [comment <text>]
fw reject <port|service> [tcp|udp] [from <ip>]
fw limit <port|service> [tcp|udp]
fw remove <rule_number>
fw remove <allow|deny> <port|service>

🏷️ Service Names

Use human-readable service names anywhere you'd use a port number:

Command	Port
fw allow ssh	22
fw allow http,https	80,443
fw deny ftp	21
fw allow mysql	3306
fw allow postgres	5432
fw allow redis	6379
fw allow mongodb	27017

100+ built-in services — see them all:

fw services              # list all
fw services redis        # filter by name

Categories: Web, SSH, FTP, Email, DNS, Databases, Message Queues, Monitoring, CI/CD, Containers, VPN, Remote Desktop, and more.

👥 Named Groups

Group IP ranges under memorable names:

# Create groups
fw group create office 192.168.1.0/24 10.0.0.0/24
fw group create cloudflare 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22

# Use in rules
fw allow 443 from cloudflare
fw allow mysql from office

# Manage groups
fw group list
fw group show office
fw group add office 172.16.0.0/16
fw group remove office 10.0.0.0/24
fw group delete old-group

Groups are stored in ~/.config/fw/groups.json.

⚙️ Management

Command	Description
fw status	Pretty status table with rule numbers
fw on	Enable firewall
fw off	Disable firewall
fw reset	Reset all rules (with confirmation)

🧭 Interactive Mode

Don't remember the syntax? Let fw guide you:

fw add

Walks you through: Action → Port/Service → Protocol → Source → Comment → Confirm.

🔧 Advanced

# Test if a connection would pass
fw test 192.168.1.50 443
fw test 10.0.0.1 ssh

# View logs
fw log                      # Recent entries
fw log blocked              # Only blocked
fw log blocked --last 1h    # Last hour

# Export / Import rules
fw export                    # → fw-rules.json
fw export backup.json
fw import backup.json

# Compare with remote server
fw diff user@production-server

# Diagnose issues
fw doctor

🩺 Doctor

fw doctor checks for:

• ✗ Firewall inactive
• ✗ Default incoming policy set to allow
• ! Duplicate rules
• ! SSH open to anywhere (not limited)
• ! Listening ports without firewall rules
• ! Logging disabled

⌨️ Tab Completion

Bash and Zsh completions are installed automatically. Supports:

• Command names
• Service names
• Protocol names (tcp/udp)
• Group names (from your groups.json)

📁 File Structure

~/.config/fw/
  └── groups.json      # Named IP groups
/usr/local/bin/fw      # Main script
/etc/bash_completion.d/fw  # Bash completions

💻 Compatibility

Distribution	Version	Status
Ubuntu	20.04+	✅ Fully supported
Ubuntu	22.04+	✅ Fully supported
Ubuntu	24.04+	✅ Fully supported
Debian	11 (Bullseye)	✅ Fully supported
Debian	12 (Bookworm)	✅ Fully supported

---

📄 License

This project is licensed under the MIT License — see the LICENSE file for details.

---

Made with ❤️ for the Linux community