{"record":{"id":"def3a75ec199590d","repo":"jdx/mise","slug":"firewall-rule-uses-protocol-which-ufw-doe","errorCode":null,"errorMessage":"firewall rule '{}' uses protocol {}, which UFW does not support; select backend = \\\"nftables\\\" or \\\"firewalld\\\"","messagePattern":"firewall rule '(.+?)' uses protocol (.+?), which UFW does not support; select backend = \\\\\"nftables\\\\\" or \\\\\"firewalld\\\\\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall.rs","lineNumber":1044,"sourceCode":"        FirewallBackend::Auto => false,\n    }\n}\n\nfn validate_backend_request(request: &FirewallRequest, backend: FirewallBackend) -> Result<()> {\n    for rule in &request.rules {\n        if backend == FirewallBackend::Firewalld && rule.interface.is_some() {\n            bail!(\n                \"firewall rule '{}' uses interface matching, which firewalld policies cannot express safely; select backend = \\\"nftables\\\" or \\\"ufw\\\"\",\n                rule.name\n            );\n        }\n        if backend == FirewallBackend::Ufw\n            && matches!(\n                rule.protocol,\n                Some(FirewallProtocol::Sctp | FirewallProtocol::Dccp)\n            )\n        {\n            bail!(\n                \"firewall rule '{}' uses protocol {}, which UFW does not support; select backend = \\\"nftables\\\" or \\\"firewalld\\\"\",\n                rule.name,\n                rule.protocol.expect(\"matched protocol\").as_str()\n            );\n        }\n    }\n    Ok(())\n}\n\nfn validate_effective_backend_request(\n    request: &FirewallRequest,\n    effective: &FirewallRequest,\n    backend: FirewallBackend,\n) -> Result<()> {\n    if effective.state == FirewallState::Enabled {\n        validate_backend_request(effective, backend)?;\n        request.validate_safety_with_rules(\n            &effective.rules,","sourceCodeStart":1026,"sourceCodeEnd":1062,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/firewall.rs#L1026-L1062","documentation":"UFW has no support for the SCTP or DCCP protocols, so `validate_backend_request` rejects a rule whose `protocol` is \"sctp\" or \"dccp\" when the effective backend is ufw, before any planning. nftables and firewalld support both protocols; alternatively drop the SCTP/DCCP-specific rule from a ufw-managed config.","triggerScenarios":"`backend = \"ufw\"` (pinned or auto-detected) plus a rule with `protocol = \"sctp\"` or `protocol = \"dccp\"` — typically needed for WebRTC/media stacks, SS7/SIGTRAN, or DCCP-based services.","commonSituations":"Copying an nftables ruleset into mise config on an Ubuntu host where ufw won; telecom/signaling workloads needing SCTP on a ufw-managed box; config shared across machines with different backends.","solutions":["Pin `backend = \"nftables\"` or `backend = \"firewalld\"` in `[bootstrap.linux.firewall]` (installing it if needed).","Drop the sctp/dccp rule if those protocols do not actually traverse this host (and drop its `port` too, since port requires protocol).","Keep the ufw config tcp/udp-only and manage SCTP/DCCP rules out-of-band with nft."],"exampleFix":"# before (mise.toml)\n[bootstrap.linux.firewall]\nbackend = \"ufw\"\n\n[[bootstrap.linux.firewall.rules]]\nname = \"sctp-media\"\nport = 5000\nprotocol = \"sctp\"\naction = \"allow\"\n\n# after\n[bootstrap.linux.firewall]\nbackend = \"nftables\"\n\n[[bootstrap.linux.firewall.rules]]\nname = \"sctp-media\"\nport = 5000\nprotocol = \"sctp\"\naction = \"allow\"","handlingStrategy":"validation","validationCode":"# pre-flight: ufw supports only tcp/udp protocols\npython3 - <<'PY'\nimport tomllib\nfw = tomllib.load(open('mise.toml','rb')).get('bootstrap',{}).get('linux',{}).get('firewall',{})\nif fw.get('backend') == 'ufw':\n    for r in fw.get('rules',[]):\n        if r.get('protocol') in ('sctp', 'dccp'):\n            raise SystemExit(f\"rule {r['name']}: ufw does not support {r['protocol']}\")\nPY","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Need SCTP/DCCP? Pin backend = \"nftables\" or \"firewalld\" from the start.","Keep ufw-backed configs tcp/udp-only.","When copying rules from nftables, re-check each protocol against the target backend."],"tags":["mise","firewall","ufw","protocol","backend","config","bootstrap"],"backgroundTag":"unsupported-feature-combination","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}