Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a virtual server running Debian. It's host OS is using Linux Vserver and due to its lack of support for network namespaces, using iptables to secure the box is not an option. I did many searches looking for alternatives but so far I'm only finding different front ends to manage iptables itself.

Is there anything else out there? I was hoping to tie it in into my OSSEC active response scripts to enable real time blocking when malicious activity is detected.

share|improve this question

As far as I know, iptables is the linux firewall. Never in all my years working with linux have I ever heard nor seen of any alternatives.

Do you have the option of just running the firewall layer on the host OS?

share|improve this answer
iptables is not a firewall. It's a user-space tool to manipulate the firewall, netfilter. – petrus May 18 '11 at 22:16
@petrus - True, but probably not worth the pedantry. – EEAA May 18 '11 at 22:18
@petrus - also, feel free to edit my answer (or any others) to correct/clarify. – EEAA May 18 '11 at 22:18
And thank god for it -- beat the heck out of ipchains. – nedm May 18 '11 at 22:29
No unfortunately I do not have access to the host OS, and since this is on a shared server I doubt they would be willing to yield to my needs. – BajaBob May 18 '11 at 23:47

There's always Debian GNU/kFreeBSD which ports the FreeBSD kernel the Debian/GNU userland. This would allow you to use pf as your firewall. Unfortunately, as of current (Debian 6/Squeeze) GNU/kFreeBSD is considered a "techninical preview", which means not ready for production.

share|improve this answer

The Linux kernel has only one built-in firewall, iptables.

There are side projects like dummynet, a Linux port of the BSD firewall, but these are for testing purposes and not to be used in production.


share|improve this answer
dummynet is not firewall, it is a simple traffic shaper. – AlexD May 19 '11 at 17:28

ip filter claims to support Linux. (I have only used it on Solaris.)

share|improve this answer

What about Bastille Linux? It can be used as firewall.

share|improve this answer
What makes you think that that is not netfilter-based? – MadHatter Feb 12 '14 at 9:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.