I have set up a new VPS at Hetzner and performed a fresh install with the 1-line installer (LAMP -mini) and was under the impression that Firewalld was installed by default. This seems to have changed, maybe in a recent update I dont know.
I can see Firewalld in ‘Unused Modules’, but I can’t seem to make it work as it’s preferable to me than the Linux firewall. If I install Firewalld via the terminal, I get locked out of the server within seconds. How do I go about installing the Firewalld module? I have looked at the download repo and can see a firewall6 file, which I am not sure is the correct one.
We switched to nftables, by default, because cloud-init in Debian and newer Ubuntu versions breaks installation of firewalld. If your VM uses cloud-init to configure network, you can’t safely install firewalld as doing so removes cloud-init (that may be why you lose access). Since this is an upstream packaging issue, there isn’t a lot we can do about it (take it up with the Debian/Ubuntu folks), and is one reason we’ve switched to nftables. We wanted to wait until Virtualmin 9 to make that switch, but it was coming up a lot and causing a lot of trouble for folks.
So, my recommendation is: Get comfortable with nftables. We include a Webmin module for it. I think it’s nicer to use, too. Firewalld is supposed to be easy, but I find it confusing and have to read docs every time I touch it. We’d been planning to switch, but it kinda got forced on us early by the breaking change in Debian/Ubuntu.
If you can’t get comfortable with nftables, I’m not sure what advice to give. EL distros don’t have the conflict that Debian and Ubuntu have, even with cloud-init installed and in use, so you can switch to a distro that didn’t break firewalld. (The Virtualmin installer will still default to nftables, but you can install firewalld without breaking networking or cloud-init on EL systems.)
If your system isn’t configured with cloud-init, you should be able to install firewall and run the Virtualmin configuration steps for it to open the firewall for all the necessary ports (virtualmin-config-system --include Firewalld --include Fail2banFirewalld). Does Hetzner have a web terminal you can use to interact with a VM that’s fallen off the network?
Thanks for such a detailed response. I guess I will be doing a bit of reading but yeah if it’s an upstream decision I have to adjust accordingly. Will mark your response as a solution. Once again many thanks for the message.