12

I have a Debian 10 VPS (virtual private server).

How to check if any firewall is already installed?

I dont have a list of all existing firewalls, so I hope there is a more general way.

3 Answers 3

14

I would have a look at the system services. It is a good idea to review the default setup, because there may be services that you don't need, and you can disable them to improve performance, even reduce the attack surface (for example there may be a webserver running, that you don't need).

To list all loaded services on your system, including failed services:

systemctl --type=service

To list active services:

systemctl list-units --type=service --state=active

If a firewall is already installed, chances are it's one of those: iptables, firewalld, ufw.

Attention: a service may be installed on your system but disabled. Which means that while it's not running it is available. For example it is possible that someone replaced the default firewall with another firewall (firewalld, ufw) but that iptables is still installed. So the fact that iptables is present does not necessarily mean it is the active firewall.

And since you mention it is a VPS: in addition to the built-in Linux firewall, the VPS may be sitting behind a hardware/software appliance of some sort, that acts as firewall or does DDOS mitigation. Upstream traffic filtering should be minimal if any, but it is something you have to clarify with the webhost.

I am assuming you have an "unmanaged" VPS, which means you are on your own and you have to protect yourself. On the other hand a "managed" VPS may have additional protections, when it is geared toward less technically proficient end users.

2
  • using a 3rd party cluster manager software based on rhel (they also do ubuntu, and others) and they used shorewall firewall. So on the surface seeing firewalld disabled one would incorrectly think no firewall was being used, when in fact there was. So I agree completely with this answer, based on experience... look over every rpm installed via rpm -qa and look at all the system services to truly know. And of course refer to manufacturer documentation if it's a clean linux distribution obtained directly from its manufacturer.
    – ron
    Apr 10, 2021 at 0:39
  • if you didn't install the operation system, don't assume someone hasn't installed some obscure firewall software... legitimately or otherwise; you would need to look at all rpm's and services to know; pretty sure a firewall would most likely have to be a service which would show up as enabled via systemctl list-unit-files
    – ron
    Apr 10, 2021 at 0:41
3

If your firewall uses the built-in kernel firewall, then sudo iptables -n -L will list all the iptables contents. If there is no firewall the output will be mostly empty.

Your VPS may have ufw already installed, so try ufw status. ufw is a simplified "façade" to the kernel firewall (so what is set with it also appears in the iptables output), but it is a lot simpler to understand/manage, so I would recommend it.

1
  • Modern systems may implement a firewall using the more modern netfilter system instead of iptables, so you might want to also try the command nft list ruleset, to check for netfilter rules using its native tool. Depending on distribution, the iptables command might be a compatibility interface for netfilter, or it might be a legacy iptables-only tool.
    – telcoM
    Apr 9, 2021 at 23:58
0

In recent Linux there is a firewall-cmd command. Run

firewall-cmd --state

Will give you an answer. For example

# firewall-cmd --state
running

Which means the firewall is active.

1
  • 4
    That only works if the system is using firewalld. Mar 10, 2021 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .