FWDeck is a safety-first terminal UI for firewalld — manage your Linux firewall the way k9s manages Kubernetes: fast, keyboard-only, and with a confirmation in front of anything that could lock you out.
- Linux with firewalld —
firewall-cmdon yourPATH. (Or use--offlineto edit the permanent config with the daemon stopped, e.g. from a rescue shell or chroot.) - Root or polkit authorization to make changes. Without it, FWDeck runs
read-only with a visible explanation and never re-executes itself with
sudo. - systemd + root for the crash-proof rollback watchdog. Where they aren't available (many containers, minimal systems), the dead-man's switch degrades to in-process rollback.
Pick your platform's package manager:
| Method | Command |
|---|---|
| crates.io (compile) | cargo install fwdeck --locked |
| Prebuilt binary (no compile) | cargo binstall fwdeck |
| Arch (AUR) | paru -S fwdeck · yay -S fwdeck |
| Nix | nix profile install github:madebydaniz/fwdeck |
| Fedora/RHEL (Copr) | sudo dnf copr enable madebydaniz/fwdeck && sudo dnf install fwdeck |
Or grab a native .deb / .rpm (amd64 & arm64) from every
release — download the one for
your architecture, then:
sudo apt install ./fwdeck_*.deb # Debian/Ubuntu
sudo dnf install ./fwdeck-*.rpm # Fedora/RHELPrebuilt signed binaries (x86_64/aarch64, glibc & static musl) with shell
completions and a man page are on the same releases.
Prefer a script? It verifies the SHA-256 checksums and the Cosign release signature before installing. Read it first, then run it:
curl -fsSL https://raw.githubusercontent.com/madebydaniz/fwdeck/main/scripts/install.sh -o install-fwdeck.sh
less install-fwdeck.sh # inspect before running
bash install-fwdeck.shOnce installed:
fwdeck doctor # checks your environment — never touches the firewall
fwdeck --read-only # look around safely; mutations are disabled
sudo fwdeck # full controlDevelopment version (latest main, unreleased):
cargo install --git https://github.com/madebydaniz/fwdeck --lockedFWDeck is distributed as an application. Its Rust library API is internal and not currently covered by semantic-versioning guarantees.
- ⏱️ Dead-man's switch — risky changes auto-revert on a countdown unless you
confirm your session still works. An out-of-process systemd watchdog is
pre-armed before the change is applied, so the revert survives a crash,
SIGKILL, or dropped SSH session. - 🔍 Runtime vs permanent scope on every row — you always know what survives a reload.
- 📋 Staged plans — batch changes, review once, apply once; or export as a
firewall-cmdscript, JSON, or Ansible playbook. - 🚨 SSH-aware — warns precisely when a change targets the zone your session depends on.
- 📸 Snapshots with diff-based restore (staged, never automatic), plus read-only snapshot and session diffs.
- 🧯 Offline mode (
--offline) — fix the permanent config from rescue/chroot, no daemon needed.
Full feature list
- 🧭 Every firewalld object on one screen: zones, services, ports, source-ports, protocols, forwards, rich rules, interfaces, sources, ipsets, policies, direct rules — plus per-zone target, intra-zone forwarding, and icmp-block inversion.
- ✅ A confirmation in front of every mutation: resource, zone, scope, connectivity risk.
- 🧙 Guided rich-rule builder — assemble valid rich-language syntax step by step.
- ↩️ Multi-level undo — every verified reversible change stacks; undo pops the most recent.
- 📊 Live nftables rule-hit counters per chain (nftables backend).
- ⌨️ Fuzzy command palette (
:) with context-aware availability; live filtering (/); global search (ctrl-f) across every view at once. - 🗑️ Multi-select bulk delete with one reviewed confirmation.
- 📜 Live kernel/netfilter log tail with a denied-packet counter.
- 🪪 Honest results: partial failures reported as partial failures, with per-step diagnostics and a JSONL audit trail.
- 🔌 Two backends behind one trait:
firewall-cmd(default, full-featured) and native D-Bus (reads + runtime edits; refuses what it can't do fully). - 🔏 Every release checksummed and signed with Cosign keyless (Sigstore).
- 🩺
fwdeck doctor, shell completions, man page, XDG config, three themes.
Every release is tested against a real firewalld daemon in CI on:
| Distro | firewalld | Status |
|---|---|---|
| Fedora 44 | 2.4.x | ✅ CI |
| Debian 13 | 2.3.x | ✅ CI |
| AlmaLinux 9 (RHEL-compatible) | 1.3.x | ✅ CI |
- Getting started
- Installation & release verification
- The interface & views
- Workflows — multi-step tasks, exact keystrokes
- Safety features
- Configuration
- FAQ & troubleshooting
No firewalld on your machine, or don't want to touch it? The dev container runs a real firewalld with seeded data, fully isolated from your host:
git clone https://github.com/madebydaniz/fwdeck.git && cd fwdeck
docker compose run --rm dev
cargo run # inside the containerIf the build can't reach crates.io (Docker's DNS is flaky on macOS), run
make warmonce to fetch the dependencies into a cached volume, thenmake runbuilds and launches fully offline — no container network needed.
Managing firewalld means the same loop every time: firewall-cmd --list-all,
scroll, --add-service, forget --permanent, --reload, check again, lose
track of which change was runtime-only. One mistyped rule on a remote box can
cost you the SSH session you're typing in. I wanted the k9s experience for
firewalld: everything visible on one screen, every change reviewed before it
lands, and a safety net when a change goes wrong. Nothing like it existed —
firewalld has no official TUI — so I built it.
- Cockpit: a great web console with a firewall page. It covers services and ports, but not rich rules, masquerade, policies, or ipsets — and it's a web service you have to run on a firewall host.
- firewall-config: the official GTK GUI — needs a desktop session, so it rarely helps on servers.
- Webmin: manages firewalld among many other things via web UI; heavier footprint and again a web service on the host.
- Raw
firewall-cmd: always works, and FWDeck never hides it — every applied step is recorded as the exact equivalent invocation. FWDeck is the review layer, not a replacement.
If FWDeck saves you from one locked-out SSH session, drop a ⭐️ on the repo!
- Bugs & feature requests: GitHub Issues
- Security reports: see SECURITY.md — please use private reporting
FWDeck is licensed under the MIT License and maintained by Daniel Niazmand · madebydaniz.com.