ansible-debian-firewall
Why and who is it forDocumentationView the playbook

Turn Linux into a code-defined firewall

ansible-debian-firewall is a collection of Ansible roles for deploying standard Debian firewalls. It covers the base system, network configuration, nftables, VPN, dynamic routing and high availability without replacing Debian with a proprietary appliance.

View the playbook
ansible-debian-firewall 1U rack appliance

What ansible-debian-firewall gives you

Free and open source

BSD-2-Clause. No edition, no paywall, no subscription.

Runs on your hardware

Built on Debian Linux: mini-PCs, servers, VMs and modern NICs.

Ansible-driven

Inventory and variables describe the target system. Ansible renders the configuration and applies it through standard Debian services.

Native, tested core

Every service integrated and tested together, upgraded as one.

A real Ansible run

The playbook applies the roles in order, validates the generated nftables policy before loading it and reports every task for both firewall nodes.

Roles and capabilities

Each row maps directly to a role or a group of tasks in the repository. There is no comparison with another product: this is the scope of the Ansible collection.

RoleWhat it configuresMain components
baseCommon Debian baselinechrony, rsyslog, unattended-upgrades, SSH
networkInterfaces and routingsystemd-networkd, VLANs, bridges, routes, sysctl
nftablesFiltering and NATstateful rules, logging, aliases, policy defaults
wireguard and strongswanEncrypted connectivityWireGuard peers and IPsec tunnels
frrDynamic routingOSPF and BGP
keepalived and conntrackdHigh availabilityVRRP and connection state synchronization

Use the repository for requirements, repository layout and the production workflow.