Hi,You can use pure "iptables" and "iptables-persistent" as a third option.
I'm a long-time Linux user (two and a half decades since Slackware
7.1). I've been using RHEL clones mainly for the last ten years or so,
on desktops as well as servers (local and Internet-facing). For
firewalling I simply chose the default Firewalld.
I understand under Debian there are different possibilities to handle firewalls. As far as I understand, ufw (Uncomplicated firewall) seems
to be the default, though Firewalld seems to be an option.
Any recommendations ?
Hi,
I'm a long-time Linux user (two and a half decades since Slackware 7.1). I've been using RHEL clones mainly for the last ten years or so, on
desktops as well as servers (local and Internet-facing). For firewalling
I simply chose the default Firewalld.
I understand under Debian there are different possibilities to handle firewalls. As far as I understand, ufw (Uncomplicated firewall) seems to
be the default, though Firewalld seems to be an option.
Any recommendations ?
Niki
I understand under Debian there are different possibilities to handle firewalls. As far as I understand, ufw (Uncomplicated firewall) seems
to be the default, though Firewalld seems to be an option.
Any recommendations ?
There is also a new kid around called "nft" which should replace
iptables, but its syntax is super weird and non-intuitive for me, so I consider it a downgrade.
On 1/19/26 14:49, Nicolas Kovacs wrote:
Hi,
I'm a long-time Linux user (two and a half decades since Slackware
7.1). I've been using RHEL clones mainly for the last ten years or
so, on desktops as well as servers (local and Internet-facing). For firewalling I simply chose the default Firewalld.
I understand under Debian there are different possibilities to
handle firewalls. As far as I understand, ufw (Uncomplicated
firewall) seems to be the default, though Firewalld seems to be an
option.
Any recommendations ?You can use pure "iptables" and "iptables-persistent" as a third
option. It will be more efficient to learn iptables syntax and use it
on any distro than learning syntax of a different wrappers for
iptables like ufw and the others.
Develop a simple ruleset and manage it with command line utils or
directly edit the rules files with text editor.
There is also a new kid around called "nft" which should replace
iptables, but its syntax is super weird and non-intuitive for me, so
I consider it a downgrade.
Luckily iptables` syntax still supported via iptables-to-nft rules translation with support for the most of iptables extensions, so for
the time being iptables syntax will stay available for use.
I understand under Debian there are different possibilities to handle firewalls. As far as I understand, ufw (Uncomplicated firewall) seems to be the default, though Firewalld seems to be an option.
Were you the person who liked ansible? If so you may be interested in a
role like this, which I use for managing nftables rules.
https://galaxy.ansible.com/ui/standalone/roles/ipr-cnrs/nftables/ documentation/
Thanks,
Andy
"Alexander V. Makartsev" <avbetev@gmail.com> writes:
[...]
There is also a new kid around called "nft" which should replace
iptables, but its syntax is super weird and non-intuitive for me, so I consider it a downgrade.
I disagree. I was happy iptables user and some time ago I migrated my
rules to nftables. Indeed this is no 1-1 migration, you have to rethink
your rules, but IMO this is more comfortable.
The main difference (IMO) is that most your dynamic logic shoud go to
sets not to the rules itself.
It is also true that iptables was re-implemented as a front-end
to nft in a previous Debian Stable release, so if you don't want
any of the new nft features, you can continue using iptables
as-is.
As you point out below, iptables is being replaced by nftables so
choosing now to learn iptables seems a silly idea. So it seems wiser to
use a frontend like ufw or firewalld that both support either backend.
I suppose ufw is simpler but firewalld may be more familiar to Nicolas.
There is also a new kid around called "nft" which should replace
iptables, but its syntax is super weird and non-intuitive for me, so
I consider it a downgrade.
Luckily iptables` syntax still supported via iptables-to-nft rules translation with support for the most of iptables extensions, so for
the time being iptables syntax will stay available for use.
| Sysop: | Jacob Catayoc |
|---|---|
| Location: | Pasay City, Metro Manila, Philippines |
| Users: | 5 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 19:03:59 |
| Calls: | 117 |
| Calls today: | 117 |
| Files: | 367 |
| D/L today: |
540 files (253M bytes) |
| Messages: | 70,845 |
| Posted today: | 26 |