ufw

function f_firewall {
  echo "[$SCRIPT_COUNT] Enable ufw"

  if ! test -f "$UFWDEFAULT"; then
    echo "$UFWDEFAULT does not exist."

    if ! dpkg -l | grep ufw 2> /dev/null 1>&2; then
      echo 'ufw package is not installed.'
    fi

    return
  fi

  sed -i 's/IPT_SYSCTL=.*/IPT_SYSCTL=\/etc\/sysctl\.conf/' "$UFWDEFAULT"

  ufw allow in on lo
  ufw allow out on lo
  ufw deny in from 127.0.0.0/8
  ufw deny in from ::1

  ufw logging on

  ufw default deny incoming

  for admin in $FW_ADMIN; do
    ufw allow log from "$admin" to any port "$SSH_PORT" proto tcp
  done

  ufw --force enable

  if [[ $VERBOSE == "Y" ]]; then
    systemctl status ufw.service --no-pager
    ufw status verbose
    echo
  fi

  ((SCRIPT_COUNT++))
}