I am looking for a good firewall for debian 5 which is a web server. Are there any good options apart from iptables? Thanks

  • 3
    What do you perceive as a reason not to use iptables? Commented Aug 3, 2009 at 0:24

7 Answers 7


I would take shorewall, a scripting engine atop of iptables. To build a sensible firewall on linux, you have to use iptables (It is the kernel network filtering mechanism). What you do not have to do, is to write iptables scripts by hand. Thats way too complex and nearly unmaintainable.

aptitude shorewall should also work.

all the config resides in /etc/shorewall and is done in straight text files. Shorewall itself is just a bash script, executed once. It does not provide a deamon!

  • 3
    +1 for Shorewall. It adds a nice zone based configuration setup to Netfilter. Commented Aug 2, 2009 at 18:22
  • 1
    Another +1 for shorewall. It should be noted that there is only one firewall in Linux, iptables. What your looking for is an interface to it.
    – David
    Commented Aug 2, 2009 at 21:51
  • 2
    @ 2nd David, ipchains finally depreciate? Commented Aug 2, 2009 at 23:16
  • guys go and learn iptables ;)
    – asdmin
    Commented Aug 3, 2009 at 8:40
  • 1
    @David: ipchains is actually 2.2; iptables was introduced in 2.4 and carried through in 2.6.
    – womble
    Commented Aug 6, 2009 at 23:35

Everything runs on iptables. You can download all kinds of software, scripts, GUI apps that can help you configure iptables without knowing all the detailed chains.

Do a apt-cache search iptables and it will list all sorts of software.

  • 4
    iptables is not the firewall system, iptables is the set of user space utilities to manage netfilter, the firewall system in the Linux kernel. Commented Aug 2, 2009 at 19:21
  • stand corrected - edited.
    – sybreon
    Commented Aug 3, 2009 at 4:03

If you pefer working from the command line (i.e., in a non-graphical environment), i would recommend ferm. You can find a good introduction on times.debian.net.

Also, at the official Debian wiki you can find a very comprehensive list of IPtables frontends from which to choose.

Please note that, as other colleagues have pointed out, these tools are just frontends for managing the firewall rules more easily (the actual packet filtering is always done with iptables, through the netfilter framework).

Best regards, Marcus


There's nothing wrong with iptables. I don't think there is an alternative. What bothers you? Is it too complicated or do you need a feature iptables is not providing?

  • 1
    Go with iptables. :-)
    – Tatas
    Commented Aug 2, 2009 at 15:39
aptitude search arno

Should give you the package name for arno iptables firewall. It is a pretty nice package with support for custom rules and plugins. To reconfigure the non-custom rules it ties into dpkg nicely.

dpkg-reconfigure arno-iptables-firewall

You could use NuFW : http://www.nufw.org/-English-.html It's a FW based on Netfilter, with user authentification.

You can find an « introduction » here : nufw.org/Introduction,1.html

For the moment, i just use NuFW for fun/learn, but i wish to switch from script-iptables to NuFW later.


Why do you want to run the firewall on the server itself. Have you considered putting a firewall (such as IPCop, pfSense, Smoothwall, etc) BETWEEN your servers and the internet?

In addition to iptables on the server itself (always a great idea) I'd consider taking it one step farther and having a physical appliance/firewall sitting in front of your server(s).

  • 1
    And what if the attack comes from a compromised machine, or malicious user, within the local network? Commented Aug 3, 2009 at 0:23
  • What if the attack comes from a rogue employee? ;-) My post did say "In addition to iptables on the server...". I was simply recommending an an external firewall in addition to a hardened web server.
    – KPWINC
    Commented Aug 3, 2009 at 1:19

Not the answer you're looking for? Browse other questions tagged .