Why and who is it for
ansible-debian-firewall is a production-oriented collection of Ansible roles for Debian firewalls. It provides a reproducible foundation for filtering, NAT, routing, VPN and high availability.
The deployment stays transparent: inventory, variables, generated rules, routes and services remain visible, reviewable and reproducible instead of being hidden in a proprietary appliance.
What makes ansible-debian-firewall different
A small set of standard Linux services, connected by Ansible and kept visible from inventory to generated configuration.
Free and open source
BSD-2-Clause, no enterprise edition, no paywalled module, no per-throughput subscription. Everyone runs the same package, and it stays yours to inspect, script and keep.
Built on Linux, runs almost anywhere
Debian runs on mini-PCs, rack servers, virtual machines and modern network hardware. The roles keep the deployment portable across physical and virtual environments.
One integrated core
The roles configure standard Debian packages and services. The repository, inventories and encrypted variables remain the source of truth, so changes can be reviewed, tested and reapplied without a proprietary package or plugin system.
Configuration stays visible
The inventory, variables, templates and generated service files remain inspectable. Changes are reviewed in Ansible and applied through standard Debian tooling, without a proprietary management layer.
What you get out of the box
The list below describes the capabilities provided by the current Ansible roles and the Debian services they configure.
Working today
- Stateful nftables filtering, NAT (outbound, port forward, 1:1) and aliases compiled to named sets.
- Interface assignment, VLANs, bridges, LAGG and tunnels through iproute2.
- Static routing and per-gateway latency, loss and availability monitoring.
- Live diagnostics: connection states, packet capture, ARP/NDP, sockets and the loaded ruleset.
- WireGuard and IPsec roles for encrypted site-to-site and remote access tunnels.
- FRR roles for dynamic routing with OSPF and related routing services.
- Keepalived and Conntrackd roles for firewall high availability.
- SSH, rsyslog, SNMP and unattended security upgrades through the base role.
- Configuration rendered as standard Debian files and services.
Being wired in
- DHCP relay and local DNS forwarding are optional services, not part of the core firewall roles.
- Switching features such as STP and complete port management belong on dedicated switches.
- Performance testing and long-run HA validation remain deployment work for each target platform.
Who it is for
ansible-debian-firewall targets the firewall the large majority of companies actually run. What is not in the core today is on the roadmap as a native feature, never as a third-party plugin.
A good fit
- Small and mid-size companies that need a reliable perimeter firewall.
- Admins who prefer Debian and standard Linux tooling under the hood.
- Teams that value a tested, predictable product they fully control.
- Anyone replacing an end-of-life appliance without a new subscription.
On the roadmap
- Optional identity integration for administration and VPN access.
Try it on a spare box
Start with a clean Debian host or VM, prepare the inventory and variables, then apply the playbook. There is no custom operating system or management portal to install.