Documentation
cmnSense is a set of Debian packages that turn Debian 13 into a firewall. Install it from the ISO or onto a Debian system you already have, then configure it from the CLI or the web interface.
Installing from the ISO
A dedicated machine or a virtual machine, from the offline installer. The quickest way to a working firewall.
Installing on Debian 13
Add the signed repository to a Debian 13 system and install the packages. Your network configuration is taken over.
First steps
Logging in, naming interfaces, a first rule and NAT, and saving the configuration so it survives a reboot.
Verifying downloads
The signing key, its fingerprints, and how to check an ISO or the repository before you trust it.
On the firewall itself
Every installation carries its own reference. The manual pages describe each program and the CLI has context help: type ? anywhere, or press Tab to complete a command.
man cmnsense-cli | The CLI: modes, show commands, filters and paging |
man cmnsense-server | The management server, its files and its maintenance commands |
man cmnsense-network-takeover | How an existing network configuration is taken over |
man cmnsense-vrrpd | VRRP for high availability |
man cmnsense-syncd | Connection state synchronisation between an HA pair |
Where things are
/etc/cmnsense/cmnsense.conf | The running configuration: every accepted change is applied and written here at once |
/etc/cmnsense/cmnsense-startup.conf | The startup configuration, loaded at boot and written by write memory |
/var/lib/cmnsense/history/ | The last 100 versions of the configuration, with who changed what and how |
/var/lib/cmnsense/initial-admin-password | The generated password of cmnsense-admin after a Debian package installation |