🚨 UFW Error: 'ERROR: problem running ufw-init' — Cause, Fix, and Troubleshooting Guide

What this error means

UFW is a front end that compiles its rules into the kernel firewall through iptables/nftables. ERROR: problem running ufw-init means the low-level ufw-init script failed to load those rules — a backend command errored out — so UFW could not enable or reload the firewall.

ERROR: problem running ufw-init
iptables-restore: line 42 failed
Problem running '/etc/ufw/before.rules'

The single-line UFW error hides the real cause; the underlying iptables-restore/nft failure it wraps is what you must read.

How it manifests on the host

• ufw enable or ufw reload prints ERROR: problem running ufw-init and exits non-zero.
• ufw status reports inactive even though you just tried to enable it.
• The error started after installing Docker, switching to nftables, or editing before.rules.
• systemctl status ufw shows a failed start.

System configuration causes

• Backend conflict. Docker or another tool programs iptables/nftables directly and collides with UFW’s chains.
• Missing kernel module. A rule uses a match (conntrack, recent, limit) whose module is not loaded, so iptables-restore fails.
• Malformed rule file. A hand-edit to /etc/ufw/before.rules or after.rules has a syntax error at the reported line.
• iptables legacy vs nft mismatch. The host uses iptables-nft but UFW invokes iptables-legacy (or vice versa), so restore behaves unexpectedly.
• xtables lock contention. Another firewall writer holds the lock while ufw-init runs.

Interrogating the host

# Run ufw-init directly to see the raw backend error UFW is hiding
sudo /usr/share/ufw/ufw-init force-reload 2>&1 | tail -20
# older paths: /lib/ufw/ufw-init

# Which iptables backend is in use?
sudo update-alternatives --display iptables 2>/dev/null
sudo iptables -V

# Are the needed modules loaded?
lsmod | grep -E 'conntrack|nf_tables|ip_tables|xt_'

# Validate custom rule files by looking at the reported line
sudo grep -n '' /etc/ufw/before.rules | sed -n '38,46p'

Running ufw-init directly surfaces the exact iptables-restore: line N failed, which points at the offending rule or missing match.

Remediation

1. Fix a bad custom rule at the reported line, then reload:

sudoedit /etc/ufw/before.rules      # correct the flagged line
sudo ufw reload

2. Load the missing module and persist it:

sudo modprobe nf_conntrack
echo nf_conntrack | sudo tee /etc/modules-load.d/ufw.conf
sudo ufw reload

3. Align the iptables backend so UFW and the host agree (modern Debian/Ubuntu default to nft):

sudo update-alternatives --set iptables /usr/sbin/iptables-nft
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
sudo systemctl restart ufw

4. Resolve a Docker conflict. Do not let both manage the same chains blindly; disable UFW-managed forwarding for Docker or use ufw-docker rules, then reload. As a last resort to recover a broken state, reset and re-add your rules:

sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw enable

Hardening the host

• Always sudo ufw allow OpenSSH (or your SSH port) before ufw enable on a remote host, or you will lock yourself out.
• ufw --force reset wipes all rules — capture the current set (ufw status numbered) first.
• Docker bypasses UFW’s INPUT rules for published ports by default; understand that interaction before assuming a port is firewalled.
• Do not mix iptables-legacy and iptables-nft tooling; standardize on one backend.

Related system errors

• firewalld ‘COMMAND_FAILED’ iptables Error Guide
• nftables ‘Could not process rule’ Error Guide
• CIS Benchmark Hardening for Linux Servers