NanoPI R4S: firewalld service on Debian (not RHEL, Fedora)

[Nayla Nikolic]

Hi

I have a NanoPI R4S and would like to run the device as a firewall 
server. My only task is to filter my network traffic with firewalld.

Now I have seen on GitHub that firewalld is a Redhat/Fedora etc project. 
Are there any major disadvantages to running firewalld on Debian? I 
would rather install Debian than Fedora on R4S.

Does firewalld run as well on Debian, as Fedora/RHEL etc?

best regards and have a nice weekend
Nayla

[Marco Moock]

Am 22.06.2024 um 08:51:43 Uhr schrieb Nayla Nikolic:
> Now I have seen on GitHub that firewalld is a Redhat/Fedora etc
> project. Are there any major disadvantages to running firewalld on
> Debian? I would rather install Debian than Fedora on R4S.
>
> Does firewalld run as well on Debian, as Fedora/RHEL etc?

It is in the Debian repository and I run it on many Debian machines.
Works fine.

[Sam Varshavchik]

Marco Moock writes:
> Am 22.06.2024 um 08:51:43 Uhr schrieb Nayla Nikolic:
> > Now I have seen on GitHub that firewalld is a Redhat/Fedora etc
> > project. Are there any major disadvantages to running firewalld on
> > Debian? I would rather install Debian than Fedora on R4S.
> >
> > Does firewalld run as well on Debian, as Fedora/RHEL etc?
>
> It is in the Debian repository and I run it on many Debian machines.
> Works fine.

Counterpoint: currently on Ubuntu 22:

root@ripper:~# firewall-cmd --runtime-to-permanent
Warning: NOT_ENABLED: br0
success

This actually fails. --runtime-to-permanent is broken. When I looked into  
it, it was an old bug that was already fixed, and some time ago; but  
firewalld in jammy is still the version with the bug. I didn't look farther,  
to determine if Ubuntu is just passing along what's in the equivalent Debian  
release, or if they're just not bothering to update.

[Marco Moock]

Am 22.06.2024 um 06:32:15 Uhr schrieb Sam Varshavchik:
> This actually fails. --runtime-to-permanent is broken. When I looked
> into it, it was an old bug that was already fixed, and some time ago;
> but firewalld in jammy is still the version with the bug. I didn't
> look farther, to determine if Ubuntu is just passing along what's in
> the equivalent Debian release, or if they're just not bothering to
> update.

firewalld is in universe, so the "community" needs to care about it.
Don't expect any update on that old version, use 24.04 or another OS.

[Sam Varshavchik]

Marco Moock writes:
> Am 22.06.2024 um 06:32:15 Uhr schrieb Sam Varshavchik:
> > This actually fails. --runtime-to-permanent is broken. When I looked
> > into it, it was an old bug that was already fixed, and some time ago;
> > but firewalld in jammy is still the version with the bug. I didn't
> > look farther, to determine if Ubuntu is just passing along what's in
> > the equivalent Debian release, or if they're just not bothering to
> > update.
>
> firewalld is in universe, so the "community" needs to care about it.
> Don't expect any update on that old version, use 24.04 or another OS.

It is true that it's not big deal to build a newer version, myself, and if  
it was easier to do that, than work around this bug, that's what I would do.  
But, then, I no longer have any idea what "LTS" mean, in that case.

[Marco Moock]

Am Sat, 22 Jun 2024 07:31:38 -0400
schrieb Sam Varshavchik :
> It is true that it's not big deal to build a newer version, myself,
> and if it was easier to do that, than work around this bug, that's
> what I would do. But, then, I no longer have any idea what "LTS"
> mean, in that case.

The normal 5-year support only applies to the packages in main and, if
possible, for restricted.

universe or multiverse are provided "as-is".
Maybe (I haven't checked) the ESM has updates to firewalld because they
at least take care about security issues in universe packages here.
Depending on your usage you may get ESM for free.

Although, I recommend upgrading to the current release.