# Network setup > [!TIP] > For modern Debian specific guide to the networking, read [The Debian Administrator's Handbook — Configuring the Network](https://www.debian.org/doc/manuals/debian-handbook/sect.network-config). > [!TIP] > Under [systemd](https://en.wikipedia.org/wiki/Systemd), [networkd](https://en.wikipedia.org/wiki/Systemd#networkd) may be used to manage networks. See `systemd-networkd`(8). ## The basic network infrastructure Let's review the basic network infrastructure on the modern Debian system. | packages | popcon | size | type | description | |:---|:---|:---|:---|:---| | `network-manager` | @-@popcon1@-@ | @-@psize1@-@ | config::NM | [NetworkManager](https://en.wikipedia.org/wiki/NetworkManager) (daemon): manage the network automatically | | `network-manager-gnome` | @-@popcon1@-@ | @-@psize1@-@ | config::NM | [NetworkManager](https://en.wikipedia.org/wiki/NetworkManager) (GNOME frontend) | | `netplan.io` | @-@popcon1@-@ | @-@psize1@-@ | config::NM+networkd | [Netplan](https://netplan.io) (generator): Unified, declarative interface to NetworkManager and systemd-networkd backends | | `ifupdown` | @-@popcon1@-@ | @-@psize1@-@ | config::ifupdown | standardized tool to bring up and down the network (Debian specific) | | `pppoeconf` | @-@popcon1@-@ | @-@psize1@-@ | config::helper | configuration helper for PPPoE connection | | `wpasupplicant` | @-@popcon1@-@ | @-@psize1@-@ | config::helper | client support for WPA and WPA2 (IEEE 802.11i) | | `wpagui` | @-@popcon1@-@ | @-@psize1@-@ | config::helper | Qt GUI client for wpa_supplicant | | `wireless-tools` | @-@popcon1@-@ | @-@psize1@-@ | config::helper | tools for manipulating Linux Wireless Extensions | | `iw` | @-@popcon1@-@ | @-@psize1@-@ | config::helper | tool for configuring Linux wireless devices | | `iproute2` | @-@popcon1@-@ | @-@psize1@-@ | config::iproute2 | [iproute2](https://wiki.linuxfoundation.org/networking/iproute2), IPv6 and other advanced network configuration: `ip`(8), `tc`(8), etc | | `iptables` | @-@popcon1@-@ | @-@psize1@-@ | config::Netfilter | administration tools for packet filtering and NAT ([Netfilter](https://en.wikipedia.org/wiki/Netfilter)) | | `nftables` | @-@popcon1@-@ | @-@psize1@-@ | config::Netfilter | administration tools for packet filtering and NAT ([Netfilter](https://en.wikipedia.org/wiki/Netfilter)) (successor to {ip,ip6,arp,eb}tables) | | `iputils-ping` | @-@popcon1@-@ | @-@psize1@-@ | test | test network reachability of a remote host by [hostname](https://en.wikipedia.org/wiki/Hostname) or [IP address](https://en.wikipedia.org/wiki/IP_address) ([iproute2](https://wiki.linuxfoundation.org/networking/iproute2)) | | `iputils-arping` | @-@popcon1@-@ | @-@psize1@-@ | test | test network reachability of a remote host specified by the [ARP](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) address | | `iputils-tracepath` | @-@popcon1@-@ | @-@psize1@-@ | test | trace the network path to a remote host | | `ethtool` | @-@popcon1@-@ | @-@psize1@-@ | test | display or change Ethernet device settings | | `mtr-tiny` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | trace the network path to a remote host (curses) | | `mtr` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | trace the network path to a remote host (curses and GTK) | | `gnome-nettool` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | tools for common network information operations (GNOME) | | `nmap` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | network mapper / port scanner ([Nmap](https://en.wikipedia.org/wiki/Nmap), console) | | `tcpdump` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | network traffic analyzer ([Tcpdump](https://en.wikipedia.org/wiki/Tcpdump), console) | | `wireshark` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | network traffic analyzer ([Wireshark](https://en.wikipedia.org/wiki/Wireshark), GTK) | | `tshark` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | network traffic analyzer (console) | | `tcptrace` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | produce a summarization of the connections from `tcpdump` output | | `dnsutils` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | network clients provided with [BIND](https://en.wikipedia.org/wiki/BIND): `nslookup`(8), `nsupdate`(8), `dig`(8) | | `dlint` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | check [DNS](https://en.wikipedia.org/wiki/Domain_Name_System) zone information using nameserver lookups | | `dnstracer` | @-@popcon1@-@ | @-@psize1@-@ | test::low-level | trace a chain of [DNS](https://en.wikipedia.org/wiki/Domain_Name_System) servers to the source | List of network configuration tools ### The hostname resolution The hostname resolution is currently supported by the [NSS (Name Service Switch)](https://en.wikipedia.org/wiki/Name_Service_Switch) mechanism too. The flow of this resolution is the following. 1. The "`/etc/nsswitch.conf`" file with stanza like "`hosts: files dns`" dictates the hostname resolution order. (This replaces the old functionality of the "`order`" stanza in "`/etc/host.conf`".) 2. The `files` method is invoked first. If the hostname is found in the "`/etc/hosts`" file, it returns all valid addresses for it and exits. (The "`/etc/host.conf`" file contains "`multi on`".) 3. The `dns` method is invoked. If the hostname is found by the query to the [Internet Domain Name System (DNS)](https://en.wikipedia.org/wiki/Domain_Name_System) identified by the "`/etc/resolv.conf`" file, it returns all valid addresses for it and exits. A typical workstation may be installed with its host name set to, e.g., "*host_name*" and its optional domain name set to an empty string. Then, "`/etc/hosts`" looks like the following. 127.0.0.1 localhost 127.0.1.1 host_name # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters Each line starts with a [IP address](https://en.wikipedia.org/wiki/IP_address) and it is followed by the associated [hostname](https://en.wikipedia.org/wiki/Hostname). The IP address `127.0.1.1` in the second line of this example may not be found on some other Unix-like systems. The [Debian Installer](https://www.debian.org/devel/debian-installer/) creates this entry for a system without a permanent IP address as a workaround for some software (e.g., GNOME) as documented in the [bug \#719621](https://bugs.debian.org/719621). The *host_name* matches the hostname defined in the "`/etc/hostname`" (see [???](#_the_hostname)). For a system with a permanent IP address, that permanent IP address should be used here instead of `127.0.1.1`. For a system with a permanent IP address and a [fully qualified domain name (FQDN)](https://en.wikipedia.org/wiki/FQDN) provided by the [Domain Name System (DNS)](https://en.wikipedia.org/wiki/Domain_Name_System), that canonical *host_name*.*domain_name* should be used instead of just *host_name*. The "`/etc/resolv.conf`" is a static file if the `resolvconf` package is not installed. If installed, it is a symbolic link. Either way, it contains information that initialize the resolver routines. If the DNS is found at IP="`192.168.11.1`", it contains the following. nameserver 192.168.11.1 The `resolvconf` package makes this "`/etc/resolv.conf`" into a symbolic link and manages its contents by the hook scripts automatically. For the PC workstation on the typical adhoc LAN environment, the hostname can be resolved via [Multicast DNS](https://en.wikipedia.org/wiki/Multicast_DNS) (mDNS) in addition to the basic `files` and `dns` methods. - [Avahi](https://en.wikipedia.org/wiki/Avahi_(software)) provides a framework for Multicast DNS Service Discovery on Debian. - It is equivalent of [Apple Bonjour / Apple Rendezvous](https://en.wikipedia.org/wiki/Bonjour_(software)). - The `libnss-mdns` plugin package provides host name resolution via mDNS for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc). - The "`/etc/nsswitch.conf`" file should have stanza like "`hosts: files mdns4_minimal [NOTFOUND=return] dns`" (see `/usr/share/doc/libnss-mdns/README.Debian` for other configurations). - A host name suffixed with the [".local"](https://en.wikipedia.org/wiki/.local) [pseudo-top-level domain](https://en.wikipedia.org/wiki/Pseudo-top-level_domain) is resolved by sending a mDNS query message in a multicast UDP packet using IPv4 address "`224.0.0.251`" or IPv6 address "`FF02::FB`". > [!NOTE] > The [expansion of generic Top-Level Domains (gTLD)](https://newgtlds.icann.org/en/program-status/delegated-strings) in the [Domain Name System](https://en.wikipedia.org/wiki/Domain_Name_System) is underway. Watch out for the [name collision](https://icannwiki.com/Name_Collision) when choosing a domain name used only within LAN. > [!NOTE] > Use of packages such as `libnss-resolve` together with `systemd-resolved`, or `libnss-myhostname`, or `libnss-mymachine`, with coressponding listings on the "`hosts`" line in the "`/etc/nsswitch.conf`" file may override the traditional network configuration discussed in the above. See `nss-resolve`(8), `systemd-resolved`(8), `nss-myhostname`(8), and `nss-mymachines`(8) for more. ### The network interface name The [systemd](https://en.wikipedia.org/wiki/Systemd) uses "[Predictable Network Interface Names](https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/)" such as "`enp0s25`". ### The network address range for the LAN Let us be reminded of the IPv4 32 bit address ranges in each class reserved for use on the [local area networks (LANs)](https://en.wikipedia.org/wiki/Local_area_network) by [rfc1918](https://datatracker.ietf.org/doc/rfc1918). These addresses are guaranteed not to conflict with any addresses on the Internet proper. > [!NOTE] > IP address written with colon are [IPv6 address](https://en.wikipedia.org/wiki/IPv6_address), e.g., "`::1`" for `localhost`. | Class | network addresses | net mask | net mask /bits | number of subnets | |:---|:---|:---|:---|:---| | A | 10.x.x.x | 255.0.0.0 | /8 | 1 | | B | 172.16.x.x — 172.31.x.x | 255.255.0.0 | /16 | 16 | | C | 192.168.0.x — 192.168.255.x | 255.255.255.0 | /24 | 256 | List of network address ranges > [!NOTE] > If one of these addresses is assigned to a host, then that host must not access the Internet directly but must access it through a gateway that acts as a proxy for individual services or else does [Network Address Translation (NAT)](https://en.wikipedia.org/wiki/Network_address_translation). The broadband router usually performs NAT for the consumer LAN environment. ### The network device support Although most hardware devices are supported by the Debian system, there are some network devices which require [DFSG](https://www.debian.org/social_contract#guidelines) non-free firmware to support them. Please see [???](#_hardware_drivers_and_firmware). ## The modern network configuration for desktop Network interfaces are typically initialized in "`networking.service`" for the `lo` interface and "`NetworkManager.service`" for other interfaces on modern Debian desktop system under `systemd`. Debian can manage the network connection via management [daemon](https://en.wikipedia.org/wiki/Daemon_(computer_software)) software such as [NetworkManager (NM)](https://en.wikipedia.org/wiki/NetworkManager) (network-manager and associated packages). - They come with their own [GUI](https://en.wikipedia.org/wiki/Graphical_user_interface) and command-line programs as their user interfaces. - They come with their own [daemon](https://en.wikipedia.org/wiki/Daemon_(computer_software)) as their backend system. - They allow easy connection of your system to the Internet. - They allow easy management of wired and wireless network configuration. - They allow us to configure network independent of the legacy `ifupdown` package. > [!NOTE] > Do not use these automatic network configuration tools for servers. These are aimed primarily for mobile desktop users on laptops. These modern network configuration tools need to be configured properly to avoid conflicting with the legacy `ifupdown` package and its configuration file "`/etc/network/interfaces`". ### GUI network configuration tools Official documentations for NM on Debian are provided in "`/usr/share/doc/network-manager/README.Debian`". Essentially, the network configuration for desktop is done as follows. 1. Make desktop user, e.g. `foo`, belong to group "`netdev`" by the following (Alternatively, do it automatically via [D-bus](https://en.wikipedia.org/wiki/D-Bus) under modern desktop environments such as GNOME and KDE). $ sudo usermod -a -G netdev foo 2. Keep configuration of "`/etc/network/interfaces`" as simple as in the following. auto lo iface lo inet loopback 3. Restart NM by the following. $ sudo systemctl restart NetworkManager 4. Configure your network via GUI. > [!NOTE] > Only interfaces which are **not** listed in "`/etc/network/interfaces`" are managed by NM to avoid conflict with `ifupdown`. > [!TIP] > If you wish to extend network configuration capabilities of NM, please seek appropriate plug-in modules and supplemental packages such as `network-manager-openconnect`, `network-manager-openvpn-gnome`, `network-manager-pptp-gnome`, `mobile-broadband-provider-info`, `gnome-bluetooth`, etc. ## The modern network configuration without GUI Under [systemd](https://en.wikipedia.org/wiki/Systemd), the network may be configured in `/etc/systemd/network/` instead. See `systemd-resolved`(8), `resolved.conf`(5), and `systemd-networkd`(8). This allows the modern network configuration without GUI. A DHCP client configuration can be set up by creating "`/etc/systemd/network/dhcp.network`". E.g.: [Match] Name=en* [Network] DHCP=yes A static network configuration can be set up by creating "`/etc/systemd/network/static.network`". E.g.: [Match] Name=en* [Network] Address=192.168.0.15/24 Gateway=192.168.0.1 ## The modern network configuration for cloud The modern network configuration for cloud may use `cloud-init` and `netplan.io` packages (see [???](#_cloud_system_initialization)). The `netplan.io` package supports `systemd-networkd` and `NetworkManager` as its network configuration backends, and enables the declarative network configuration using [YAML](https://en.wikipedia.org/wiki/YAML) data. When you change YAML: - Run "`netplan generate`" command to generate all the necessary backend configuration from [YAML](https://en.wikipedia.org/wiki/YAML). - Run "`netplan apply`" command to apply the generated configuration to the backends. See ["Netplan documentation"](https://netplan.io/reference), `netplan`(5), `netplan-generate`(8), and `netplan-apply`(8). See also ["Cloud-init documentation"](https://cloudinit.readthedocs.io/en/latest/index.html) (especially around ["Configuration sources"](https://cloudinit.readthedocs.io/en/latest/explanation/configuration.html) and ["Netplan Passthrough"](https://cloudinit.readthedocs.io/en/latest/reference/network-config-format-v2.html#netplan-passthrough)) for how `cloud-init` can integrate `netplan.io` configuration with alternative data sources. ### The modern network configuration for cloud with DHCP A DHCP client configuration can be set up by creating a data source file "`/etc/netplan/50-dhcp.yaml`": network: version: 2 ethernets: all-en: match: name: "en*" dhcp4: true dhcp6: true ### The modern network configuration for cloud with static IP A static network configuration can be set up by creating a data source file "`/etc/netplan/50-static.yaml`": network: version: 2 ethernets: eth0: addresses: - 192.168.0.15/24 routes: - to: default via: 192.168.0.1 ### The modern network configuration for cloud with Network Manager The network client configuration using Network Manager infrastructure can be set up by creating a data source file "`/etc/netplan/00-network-manager.yaml`": network: version: 2 renderer: NetworkManager ## The low level network configuration For the low level network configuration on Linux, use the [iproute2](https://wiki.linuxfoundation.org/networking/iproute2) programs (`ip`(8), …) . ### Iproute2 commands [Iproute2](https://wiki.linuxfoundation.org/networking/iproute2) commands offer complete low-level network configuration capabilities. Here is a translation table from obsolete [net-tools](https://wiki.linuxfoundation.org/networking/net-tools) commands to new [iproute2](https://wiki.linuxfoundation.org/networking/iproute2) etc. commands. | obsolete net-tools | new iproute2 etc. | manipulation | |:---|:---|:---| | `ifconfig`(8) | `ip addr` | protocol (IP or IPv6) address on a device | | `route`(8) | `ip route` | routing table entry | | `arp`(8) | `ip neigh` | ARP or NDISC cache entry | | `ipmaddr` | `ip maddr` | multicast address | | `iptunnel` | `ip tunnel` | tunnel over IP | | `nameif`(8) | `ifrename`(8) | name network interfaces based on MAC addresses | | `mii-tool`(8) | `ethtool`(8) | Ethernet device settings | Translation table from obsolete `net-tools` commands to new `iproute2` commands See `ip`(8) and [Linux Advanced Routing & Traffic Control](https://lartc.org/). ### Safe low level network operations You may use low level network commands as follows safely since they do not change network configuration. | command | description | |:---|:---| | `ip addr show` | display the link and address status of active interfaces | | `route -n` | display all the routing table in numerical addresses | | `ip route show` | display all the routing table in numerical addresses | | `arp` | display the current content of the [ARP](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) cache tables | | `ip neigh` | display the current content of the [ARP](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) cache tables | | `plog` | display ppp daemon log | | `ping yahoo.com` | check the Internet connection to "`yahoo.com`" | | `whois yahoo.com` | check who registered "`yahoo.com`" in the domains database | | `traceroute yahoo.com` | trace the Internet connection to "`yahoo.com`" | | `tracepath yahoo.com` | trace the Internet connection to "`yahoo.com`" | | `mtr yahoo.com` | trace the Internet connection to "`yahoo.com`" (repeatedly) | | `dig [@dns-server.com] example.com [{a|mx|any}]` | check [DNS](https://en.wikipedia.org/wiki/Domain_Name_System) records of "`example.com`" by "`dns-server.com`" for a "`a`", "`mx`", or "`any`" record | | `iptables -L -n` | check packet filter | | `ss -a` | find all open ports | | `ss -l` | find listening ports | | `ss -l -t -n` | find listening TCP ports (numeric) | | `dlint example.com` | check DNS zone information of "`example.com`" | List of low level network commands > [!TIP] > Some of these low level network configuration tools reside in "`/usr/sbin/`". You may need to issue full command path such as "`/usr/sbin/ifconfig`" or add "`/usr/sbin`" to the "`$PATH`" list in your "`~/.bashrc`". ## Network optimization Generic network optimization is beyond the scope of this documentation. I touch only subjects pertinent to the consumer grade connection. | packages | popcon | size | description | |:---|:---|:---|:---| | `iftop` | @-@popcon1@-@ | @-@psize1@-@ | display bandwidth usage information on an network interface | | `iperf` | @-@popcon1@-@ | @-@psize1@-@ | Internet Protocol bandwidth measuring tool | | `ifstat` | @-@popcon1@-@ | @-@psize1@-@ | InterFace STATistics Monitoring | | `bmon` | @-@popcon1@-@ | @-@psize1@-@ | portable bandwidth monitor and rate estimator | | `ethstatus` | @-@popcon1@-@ | @-@psize1@-@ | script that quickly measures network device throughput | | `bing` | @-@popcon1@-@ | @-@psize1@-@ | empirical stochastic bandwidth tester | | `bwm-ng` | @-@popcon1@-@ | @-@psize1@-@ | small and simple console-based bandwidth monitor | | `ethstats` | @-@popcon1@-@ | @-@psize1@-@ | console-based Ethernet statistics monitor | | `ipfm` | @-@popcon1@-@ | @-@psize1@-@ | bandwidth analysis tool | List of network optimization tools ### Finding optimal MTU NM normally sets optimal [Maximum Transmission Unit (MTU)](https://en.wikipedia.org/wiki/Maximum_transmission_unit) automatically. In some occasion, you may wish to set MTU manually after experiments with `ping`(8) with "`-M do`" option to send a ICMP packet with various data packet size. MTU is the maximum succeeding data packet size without IP fragmentation plus 28 bytes for the IPv4 and plus 48 bytes for the IPv6. For example the following finds MTU for IPv4 connection to be 1460 and MTU for IPv6 connection to be 1500. $ ping -4 -c 1 -s $((1500-28)) -M do www.debian.org PING (149.20.4.15) 1472(1500) bytes of data. ping: local error: message too long, mtu=1460 --- ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms $ ping -4 -c 1 -s $((1460-28)) -M do www.debian.org PING (130.89.148.77) 1432(1460) bytes of data. 1440 bytes from klecker-misc.debian.org (130.89.148.77): icmp_seq=1 ttl=50 time=325 ms --- ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 325.318/325.318/325.318/0.000 ms $ ping -6 -c 1 -s $((1500-48)) -M do www.debian.org PING www.debian.org(mirror-csail.debian.org (2603:400a:ffff:bb8::801f:3e)) 1452 data bytes 1460 bytes from mirror-csail.debian.org (2603:400a:ffff:bb8::801f:3e): icmp_seq=1 ttl=47 time=191 ms --- www.debian.org ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 191.332/191.332/191.332/0.000 ms This process is [Path MTU (PMTU) discovery](https://en.wikipedia.org/wiki/Path_MTU_discovery) ([RFC1191](https://datatracker.ietf.org/doc/rfc1191/)) and the `tracepath`(8) command can automate this. | network environment | MTU | rationale | |:----------------------------------|:-----|:---------------------| | Dial-up link (IP: PPP) | 576 | standard | | Ethernet link (IP: DHCP or fixed) | 1500 | standard and default | Basic guide lines of the optimal MTU value In addition to these basic guide lines, you should know the following. - Any use of tunneling methods ([VPN](https://en.wikipedia.org/wiki/Virtual_private_network) etc.) may reduce optimal MTU further by their overheads. - The MTU value should not exceed the experimentally determined PMTU value. - The bigger MTU value is generally better when other limitations are met. The [maximum segment size](https://en.wikipedia.org/wiki/Maximum_segment_size) (MSS) is used as an alternative measure of packet size. The relationship between MSS and MTU are the following. - MSS = MTU - 40 for IPv4 - MSS = MTU - 60 for IPv6 > [!NOTE] > The `iptables`(8) (see [Netfilter infrastructure](#_netfilter_infrastructure)) based optimization can clamp packet size by the MSS and is useful for the router. See "TCPMSS" in `iptables`(8). ### WAN TCP optimization The TCP throughput can be maximized by adjusting TCP buffer size parameters as in "[TCP tuning](https://en.wikipedia.org/wiki/TCP_tuning)" for the modern high-bandwidth and high-latency WAN. So far, the current Debian default settings serve well even for my LAN connected by the fast 1G bps FTTP service. ## Netfilter infrastructure [Netfilter](https://en.wikipedia.org/wiki/Netfilter) provides infrastructure for [stateful firewall](https://en.wikipedia.org/wiki/Stateful_firewall) and [network address translation (NAT)](https://en.wikipedia.org/wiki/Network_address_translation) with [Linux kernel](https://en.wikipedia.org/wiki/Linux_kernel) modules (see [???](#_the_kernel_module_initialization)). | packages | popcon | size | description | |:---|:---|:---|:---| | `nftables` | @-@popcon1@-@ | @-@psize1@-@ | administration tools for packet filtering and NAT ([Netfilter](https://en.wikipedia.org/wiki/Netfilter)) (successor to {ip,ip6,arp,eb}tables) | | `iptables` | @-@popcon1@-@ | @-@psize1@-@ | administration tools for [netfilter](https://en.wikipedia.org/wiki/Netfilter) (`iptables`(8) for IPv4, `ip6tables`(8) for IPv6) | | `arptables` | @-@popcon1@-@ | @-@psize1@-@ | administration tools for [netfilter](https://en.wikipedia.org/wiki/Netfilter) (`arptables`(8) for ARP) | | `ebtables` | @-@popcon1@-@ | @-@psize1@-@ | administration tools for [netfilter](https://en.wikipedia.org/wiki/Netfilter) (`ebtables`(8) for Ethernet bridging) | | `iptstate` | @-@popcon1@-@ | @-@psize1@-@ | continuously monitor [netfilter](https://en.wikipedia.org/wiki/Netfilter) state (similar to `top`(1)) | | `ufw` | @-@popcon1@-@ | @-@psize1@-@ | [Uncomplicated Firewall (UFW)](https://en.wikipedia.org/wiki/Uncomplicated_Firewall) is a program for managing a netfilter firewall | | `gufw` | @-@popcon1@-@ | @-@psize1@-@ | graphical user interface for [Uncomplicated Firewall (UFW)](https://en.wikipedia.org/wiki/Uncomplicated_Firewall) | | `firewalld` | @-@popcon1@-@ | @-@psize1@-@ | [firewalld](https://en.wikipedia.org/wiki/Firewalld) is a dynamically managed firewall program with support for network zones | | `firewall-config` | @-@popcon1@-@ | @-@psize1@-@ | graphical user interface for [firewalld](https://en.wikipedia.org/wiki/Firewalld) | | `shorewall-init` | @-@popcon1@-@ | @-@psize1@-@ | [Shoreline Firewall](https://en.wikipedia.org/wiki/Shorewall) initialization | | `shorewall` | @-@popcon1@-@ | @-@psize1@-@ | [Shoreline Firewall](https://en.wikipedia.org/wiki/Shorewall), [netfilter](https://en.wikipedia.org/wiki/Netfilter) configuration file generator | | `shorewall-lite` | @-@popcon1@-@ | @-@psize1@-@ | [Shoreline Firewall](https://en.wikipedia.org/wiki/Shorewall), [netfilter](https://en.wikipedia.org/wiki/Netfilter) configuration file generator (light version) | | `shorewall6` | @-@popcon1@-@ | @-@psize1@-@ | [Shoreline Firewall](https://en.wikipedia.org/wiki/Shorewall), [netfilter](https://en.wikipedia.org/wiki/Netfilter) configuration file generator (IPv6 version) | | `shorewall6-lite` | @-@popcon1@-@ | @-@psize1@-@ | [Shoreline Firewall](https://en.wikipedia.org/wiki/Shorewall), [netfilter](https://en.wikipedia.org/wiki/Netfilter) configuration file generator (IPv6, light version) | List of firewall tools See [The netfilter.org "nftables" project](https://www.netfilter.org/projects/nftables/index.html) for the newer user space `nft`(8) command in the `nftables` package. (Linux kernel \>= 3.13) See [The netfilter.org "iptables" project](https://www.netfilter.org/projects/iptables/index.html) for the older user space `iptables`(8) and similar commands in the `iptables` and similar packages. (Linux kernel \>= 2.4.x) You can manually configure [netfilter](https://en.wikipedia.org/wiki/Netfilter) interactively from shell, save its state with "`nft list ruleset > file`" or `iptables-save`(8), and restore it via init script with "`nft -f file`" or `iptables-restore`(8) upon system reboot. Configuration helper scripts such as [shorewall](https://en.wikipedia.org/wiki/Shorewall) ease this process. See documentations at [Netfilter Documentation](https://www.netfilter.org/documentation/) (or in "`/usr/share/doc/iptables/html/`"). - [Linux Networking-concepts HOWTO](https://www.netfilter.org/documentation/HOWTO/networking-concepts-HOWTO.html) - [Linux 2.4 Packet Filtering HOWTO](https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html) - [Linux 2.4 NAT HOWTO](https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.html) - [nftables HOWTO](https://wiki.nftables.org/wiki-nftables/index.php/Main_Page)