# Ensure iptables-persistent is not installed with ufw

Necessity: Running multiple firewall management tools, such as UFW (Uncomplicated Firewall) and iptables-persistent, on the same system can create conflicting rules and unpredictable network behavior. This misconfiguration can inadvertently open security holes, as rules from one tool might override or negate rules from another, making the system's security posture difficult to audit and maintain. The primary risk is a firewall that fails to block malicious traffic as intended, leaving the system vulnerable to attack. Enforcing a single firewall management tool ensures a clear, consistent, and auditable set of rules.

Auditing and Remediation: The audit script verifies which firewall management packages are installed to detect a potential conflict. It specifically checks for the presence of 'ufw' and 'iptables-persistent'. The remediation script resolves this conflict by uninstalling the non-preferred tool, ensuring that only one utility is responsible for managing the system's netfilter rules.

Recommended State Rationale:
- Basic: ['UFW Only', 'Iptables Only'] - The fundamental security requirement is to avoid conflicting firewall managers. This state ensures that, at a minimum, only one tool is active, preventing rule conflicts regardless of which tool is chosen.
- Moderate: ['UFW Only'] - This state recommends standardizing on UFW, which is the default and most user-friendly firewall interface for Ubuntu. Standardizing simplifies administration, reduces the learning curve, and lowers the risk of human error, which is a common source of security misconfigurations.
- Strict: ['UFW Only'] - The strict recommendation aligns with the moderate one because using the OS-native, simplified management tool is considered a best practice. It ensures the system is managed in a predictable, supportable, and secure manner, leaving no room for the ambiguity that could arise from using alternative or multiple tools.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['UFW Only', 'Iptables Only']` |
| **Moderate** | `['UFW Only']` |
| **Strict** | `['UFW Only']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks the installation status of both 'ufw' and 'iptables-persistent' packages. The script must use 'dpkg-query -W -f='${Status}' <package>' for both. If 'ufw' is installed and 'iptables-persistent' is not, it must return only the string 'UFW Only'. If 'iptables-persistent' is installed and 'ufw' is not, it must return 'Iptables Only'. If both are installed, it must return 'Conflict'. If neither is installed, it must return 'None'. The output should contain no other text or formatting.

## Remediation Script Working

shell script that accepts a single positional argument: either 'ufw' or 'iptables-persistent'. If the argument is 'ufw', the script must use 'apt-get purge -y iptables-persistent' to remove the conflicting package. If the argument is 'iptables-persistent', it must use 'apt-get purge -y ufw' to remove ufw. The script must return only 'true' upon successful removal or if the conflicting package was not installed, and 'false' if the removal command fails.

