#1 2025-03-11 12:46:24

Pirx

Member

Registered: 2018-08-27

Posts: 176

Should we still use firewall?

Majority of Linux distros comes with a firewall preinstalled, but it's usually disabled by default. I always enable it with a very simple rule (outgoing - yes, incoming - no), but many people argue that there is no need to do it, because your router/ISP provides one for you. Do you use firewall on your home/desktop machine (we're not discussing servers here)?

Last edited by Pirx (2025-03-11 12:46:40)

marens

Member

From: World without M$

Registered: 2023-02-02

Posts: 827

Re: Should we still use firewall?

$ sudo ufw status verbose
[sudo] password for marens: 
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

---

If people would know how little brain is ruling the world, they would die of fear.

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,063

Website

Re: Should we still use firewall?

The router's hardware firewall should be all you need if your local network can be trusted but most routers have out of date software and/or firmware and may be vulnerable. That being the case a basic firewall on the local machines can be a good idea, especially if you're running something like Debian that enables and starts systemd services provided by packages automatically on installation.

I use nftables and the supplied workstation configuration with an extra hole punched for SSH:

~$ cat /etc/nftables.conf               
flush ruleset

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;

		# accept any localhost traffic
		iif lo accept

		# accept traffic originated from us
		ct state established,related accept

		# allow ssh
		tcp dport ssh accept

		# accept neighbour discovery otherwise IPv6 connectivity breaks
		icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
	}
}
~$ doas nft list ruleset   
table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" accept
		ct state established,related accept
		tcp dport 22 accept
		icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
	}
}
~$

Apologies for the stupidly wide tabs, I use 3-space tabs (which is the correct amount) but the forum software has inserted 8 spaces. Grrr.

---

Para todos todo, para nosotros nada

Pirx

Member

Registered: 2018-08-27

Posts: 176

Re: Should we still use firewall?

That being the case a basic firewall on the local machines can be a good idea, especially if you're running something like Debian that enables and starts systemd services provided by packages automatically on installation.

Then why all Debian-based distros come with a firewall that is disabled by default? I just don't get it...

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,063

Website

Re: Should we still use firewall?

In most distributions (including Debian-based), the firewall is enabled by default but it is set to allow all traffic, which is the only sensible default.

---

Para todos todo, para nosotros nada

Pirx

Member

Registered: 2018-08-27

Posts: 176

Re: Should we still use firewall?

Wouldn't be not including firewall at all a more sensible default?

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,063

Website

Re: Should we still use firewall?

The firewall is part of the kernel. Not including the userspace tools needed to manipulate the firewall would mean that users would have to connect to the network without a firewall to download the tools needed to bring it up.

---

Para todos todo, para nosotros nada

Pirx

Member

Registered: 2018-08-27

Posts: 176

Re: Should we still use firewall?

But if the firewall is set to allow all traffic then what's the difference?

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,063

Website

Re: Should we still use firewall?

The firewall needs to be present at first boot because security-conscious users won't want to connect without one but it must have an open ruleset because otherwise it would restrict some users unnecessarily.

---

Para todos todo, para nosotros nada

Pirx

Member

Registered: 2018-08-27

Posts: 176

Re: Should we still use firewall?

OK. That makes sense.