# Ensure ufw is not in use with iptables

Necessity: Running multiple firewall utilities simultaneously, such as UFW and iptables-persistent, creates a complex and potentially insecure environment. UFW is the default, user-friendly firewall management tool for Ubuntu, acting as a frontend for iptables. The 'iptables-persistent' service saves and restores raw iptables rules across reboots, which can directly conflict with or override the rules managed by UFW. This conflict can lead to unpredictable network behavior and create unintentional security holes, as a rule from one system might negate a critical security policy from the other. The primary risk is an insecure firewall state where traffic that should be blocked is inadvertently allowed.\n\nAuditing and Remediation: The audit script verifies whether the 'iptables-persistent' package is installed, as its presence is the prerequisite for this conflict. The remediation script resolves the potential conflict by completely removing the 'iptables-persistent' package, ensuring that UFW is the sole authority for managing the system's firewall rules.\n\nRecommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Not Installed'. This is a binary security control; there is no safe middle ground. To ensure a predictable, manageable, and secure firewall policy, only one management tool should be active. Given that UFW is the standard for Ubuntu, removing any conflicting tools like 'iptables-persistent' is the only recommended practice. This eliminates rule conflicts and centralizes firewall administration, which is a fundamental security best practice.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the installation status of the 'iptables-persistent' package. The script must output 'Installed' if the package is installed and 'Not Installed' if it is not. The output should not contain any additional text, labels, or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state ('Not Installed'). If the argument is 'Not Installed', the script should execute 'apt-get purge -y iptables-persistent' to remove the package. The script must return 'true' upon successful removal or if the package is already uninstalled, and 'false' if the removal fails.

