Production-oriented Ansible roles for building secure, auditable and reproducible Debian 13 and Debian 14 firewalls.
Project website: muros.org
The website presents the architecture, supported capabilities and operating model of this repository.
The project provides a complete perimeter firewall foundation based on standard Debian components. It is designed for teams that need transparent infrastructure, controlled changes and operational consistency without a proprietary appliance or opaque management layer.
The firewall is defined as code and deployed with standard Ansible. Network configuration, packet filtering, VPNs, routing and high availability remain visible in the repository and can be reviewed like any other infrastructure change.
- Stateful nftables firewall with filtering, NAT, logging and policy defaults
- Debian 13 and Debian 14 with systemd-networkd network configuration
- WireGuard VPN with peer management
- StrongSwan IPsec VPN
- FRRouting for OSPF and BGP dynamic routing
- Keepalived VRRP high availability
- conntrackd session state synchronization
- Standalone and active-passive firewall deployments
- Reproducible execution through a single playbook
- BSD 2-Clause licensed and free to adapt
| Role | Responsibility |
|---|---|
base |
Chrony, rsyslog and common Debian services |
network |
Interfaces, VLANs, bridges, routes, sysctl and systemd-networkd |
nftables |
Stateful firewall policy, NAT, logging and aliases |
wireguard |
WireGuard interfaces, peers and HA-aware configuration |
strongswan |
IPsec tunnels and authentication configuration |
frr |
OSPF, BGP and dynamic routing services |
keepalived |
VRRP virtual IP and failover management |
conntrackd |
Stateful connection synchronization between nodes |
- Debian 13 and Debian 14
- Ansible 2.15 or newer
- SSH access with privilege escalation
- Two nodes for high availability features
Clone the repository, review the inventory and adapt the variables to your environment.
git clone https://github.com/petrouz/muros.git
cd muros
ansible-galaxy collection install -r requirements.yml
ansible-playbook -i inventory.yml site.yml
The inventory and variables are deliberately explicit. Keep environment-specific values in host_vars and group_vars, protect sensitive values with Ansible Vault and review the rendered configuration before applying it to production.
The recommended workflow is to validate changes in a pre-production environment, review the Ansible diff, apply one node at a time in an HA pair and verify routing, VPN and session state after failover.
Firewall policy should be treated as production code. Changes should be peer reviewed, tested against expected traffic and documented in the changelog.
site.yml Main deployment playbook
inventory.yml Example inventory
group_vars/ Shared variables
host_vars/ Host-specific variables
roles/ Firewall automation roles
docs/ GitHub Pages landing page
This project is infrastructure automation, not a security certification. Review every default, restrict management access, protect secrets with Ansible Vault or an external secret manager and test the resulting policy before production use.
BSD 2-Clause License. See LICENSE.
The project has a dedicated GitHub Pages website with an overview of the firewall architecture, Ansible roles, security model and deployment capabilities.