A firewall built on common sense
cmnSense is an open source firewall distribution for Debian 13. One IOS-style configuration drives nftables, routing, VPNs, load balancing and high availability, from a Cisco-like CLI or a web interface, with the same result either way.
Installer ISO for amd64 and arm64, or add it to an existing Debian 13.
hostname edge
!
interface eth0
nameif wan
ip address dhcp
!
interface eth1
nameif lan
ip address 10.10.0.1/24
!
object-group network web-servers
network-object 10.10.0.10 remark www1
!
access-list lan extended permit ip lan:network any
access-list wan extended permit tcp any object-group web-servers eq 443
!
nat (lan,wan) dynamic interface source lan:network
nat (wan,lan) static tcp interface 443 10.10.0.10 443
Designed like network equipment, built like modern software
No web application writing files and running shell commands behind the scenes: a typed configuration model, a language to express it, and the kernel's own interfaces to apply it.
A Cisco-style language, a complete CLI
nameif, access-list, object-group, nat (lan,wan), router bgp, write memory. The whole configuration and every status view from an ASA and IOS style command line, with abbreviations and context help.
A modern nftables firewall
Rules, NAT and anti-lockout compile into one nftables ruleset that is replaced in a single atomic transaction. There is never a moment with half a policy loaded.
Native kernel interfaces, no shell tools
Interfaces, addresses, routes, rules, connection tracking, WireGuard, L2TPv3 and IPVS are programmed over netlink. No ip, nft or iptables commands, and no parsing of their output.
API first, no PHP
A Rust management server owns the configuration. The web interface and the CLI are both clients of its API, which is described by an OpenAPI 3.1 contract and open to your automation.
One file is the whole firewall
Interfaces, rules, NAT, routing, VPNs and services live in one text configuration. Copy it to another box and that box becomes identical. Diff it, keep it in Git, review it.
Debian underneath, not a fork
cmnSense is a set of packages on stock Debian 13. Security updates come from Debian, the firewall from a signed APT repository. Nothing to rebuild, nothing to wait for.
Everything a perimeter needs
Built from the components that already run the internet, nftables, IPVS, FRR, strongSwan, WireGuard, Kea, and managed as one system.
Firewall and NAT
Stateful nftables rules per interface, object groups, schedules, logging, source and destination NAT, NAT66 and port forwards with hairpin NAT, all compiled into one atomic ruleset.
Routing
Static and policy routing with gateway groups and failover, plus BGP, OSPF, OSPFv3, IS-IS and BFD through FRR, configured in the same file.
High availability
Active/standby pairs with VRRP for IPv4 and IPv6, connection state synchronisation and configuration sync, so established sessions survive a failover.
VPN
WireGuard, route-based IPsec IKEv2 with strongSwan, and L2TPv3 pseudowires that can be bundled with LACP for layer 2 links between sites.
Interfaces
VLANs, VLAN-aware bridges, LACP port-channels, GRE, GRETAP and VXLAN tunnels, and uplinks by PPPoE, DHCP or DHCPv6 with prefix delegation.
Network services
DHCPv4 and DHCPv6 servers with Kea, a caching DNS resolver, NTP with NTS through chrony, and IPv6 router advertisements.
Load balancer
A full layer 4 load balancer in the kernel with IPVS: Maglev and other schedulers, TCP and HTTP health probes, draining, and sessions that survive a failover.
Passkeys
Sign in to the web interface with Touch ID, Windows Hello, a phone or a security key. Phishing-resistant, no username to type, user verification required.
The web interface and the CLI, side by side
Every page of the web interface edits the same configuration the CLI does. Change a rule in one and it is there in the other, with the same validation.
The dashboard: system health, interfaces, live traffic and services at a glance.
Two ways to install
Boot the installer on a bare machine or a virtual machine, or add cmnSense to a Debian 13 system you already run. Both end with the same firewall, kept up to date by apt.
The installer ISO
The Debian installer with cmnSense on board. It installs without network access and asks only for the keyboard, time zone, network, disk and passwords.
On Debian 13
Three commands on a fresh Debian 13 install. The current network setup is taken over and saved.
shell
curl -fsSLO https://apt.cmnsense.org/cmnsense-archive-keyring.deb sudo apt install ./cmnsense-archive-keyring.deb sudo apt update && sudo apt install cmnsense
Built like a security product
A firewall is only as trustworthy as the box it runs on. cmnSense is designed so that the parts facing you hold as little privilege as possible.
Passkeys built in
WebAuthn passkeys for the web interface: phishing-resistant, username-less, with user verification. Only public keys are stored, and adding one requires the password again.
Least privilege
The management server runs as an unprivileged user with only CAP_NET_ADMIN, in a tightly sandboxed systemd unit, and talks to the kernel over netlink.
Strong logins
argon2id password hashes, SSH keys for the CLI, throttled logins that do not reveal which users exist, and automatic blocking of SSH brute force.
Signed end to end
Packages come from a signed APT repository, and every ISO is listed in a signed SHA256SUMS file. The installer verifies its own packages offline.
No lockouts
Anti-lockout rules keep management access open on the interface you choose, and the running configuration is kept apart from the one the box boots with.
Every change on record
Each version of the configuration is kept with who changed it and how, from the CLI, the web interface or a file edit, and any of them can be restored.