Couldn't Manage Firewall Setup on Debian 12 Using nft, but ufw Worked as Intended
In this article, we will discuss the challenges faced when setting up a firewall on Debian 12 using nft and how ufw turned out to be a better alternative. The article will cover the key concepts related to firewall setup and management on Debian 12. We will also provide detailed context and cover the subtopics using appropriate headings and paragraphs.
Introduction
Setting up a firewall is an essential step in securing any system, and Debian 12 is no exception. A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between a trusted internal network and untrusted external network, such as the internet.
Firewall Setup on Debian 12
Debian 12 provides two firewall management tools: nft and ufw. nft is a modern and flexible firewall management tool that is widely used in the industry. However, setting up nft can be challenging, especially for beginners. In this article, we will discuss the challenges faced when setting up a firewall on Debian 12 using nft and how ufw turned out to be a better alternative.
Challenges with nft
nft is a powerful and flexible firewall management tool, but it can be challenging to set up, especially for beginners. The syntax of nft is different from traditional firewall management tools, and it requires a steep learning curve. Additionally, nft is not installed by default on Debian 12, and it needs to be installed manually.
Another challenge with nft is that it does not provide a user-friendly interface for managing firewall rules. All the rules need to be written in a command-line interface, which can be time-consuming and error-prone. Furthermore, nft does not provide any default rules, and the administrator needs to create all the rules from scratch.
ufw to the Rescue
ufw, or Uncomplicated Firewall, is a user-friendly firewall management tool that is installed by default on Debian 12. ufw provides a simple and intuitive interface for managing firewall rules. It also provides default rules that can be used as a starting point for creating custom rules.
Setting up ufw is straightforward. The administrator can enable or disable ufw using a single command. The default policy for incoming and outgoing traffic can also be set using a single command. Additionally, ufw provides a simple syntax for creating custom rules, which can be applied to specific ports, protocols, or IP addresses.
Setting up a firewall on Debian 12 using nft can be challenging, especially for beginners. However, ufw provides a user-friendly interface for managing firewall rules and is installed by default on Debian 12. In this article, we have discussed the challenges faced when setting up a firewall on Debian 12 using nft and how ufw turned out to be a better alternative. We hope that this article has provided valuable insights into firewall setup and management on Debian 12.
References
- Debian 12 Firewall Configuration with nft and ufw https://www.linuxtechi.com/debian-12-firewall-configuration-nft-ufw/
- ufw - Uncomplicated Firewall https://wiki.debian.org/ufw
- nft - The Netfilter Table Framework https://wiki.nftables.org/
# Sample nft firewall configuration
table inet filter {
set input\_set {
type ipv4\_addr\_t → counter
elements = { 192.168.0.1, 192.168.0.2 }
}
chain input {
type filter hook input priority 0; policy drop;
tcp dport { 22, 80, 443 } accept
udp dport { 53, 123 } accept
icmp type echo-request accept
ct state established,related accept
counter drop
}
chain forward {
type filter hook forward priority 0; policy drop;
counter drop
}
chain output {
type filter hook output priority 0; policy accept;
counter accept
}
}
table ip6 filter {
chain input {
type filter hook input priority 0; policy drop;
tcp dport { 22, 80, 443 } accept
udp dport { 53, 123 } accept
icmp type echo-request accept
ct state established,related accept
counter drop
}
chain forward {
type filter hook forward priority 0; policy drop;
counter drop
}
chain output {
type filter hook output priority 0; policy accept;
counter accept
}
}
# Sample ufw firewall configuration
# Allow incoming SSH connections
sudo ufw allow 22/tcp
# Allow incoming HTTP and HTTPS connections
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Allow incoming DNS requests
sudo ufw allow 53/udp
# Allow incoming NTP requests
sudo ufw allow 123/udp
# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Enable ufw
sudo ufw enable