Debian 12 (IONOS) + nftables + DjangoPBX — Essential Steps

[lidiomar]

Hi Guys.
Recently I needed to apply adjustments to Debian 12 on VPS Ionos to successfully complete the DjangoPBX installation. Details are provided below to help anyone who needs them.

Context (IONOS VPS)​

• Debian 12 is delivered without nftables installed
• iptables exists only for compatibility (nf_tables backend)
• The firewall is fully open by default
• For DjangoPBX / FreeSWITCH, a controlled firewall is strongly recommended
  
  

• Ensure SSH access (critical step)​

  Before changing the firewall:
  
  iptables -I INPUT -p tcp --dport 22 -j ACCEPT
  
  

  Remove iptables persistence (if installed)​

  apt purge iptables-persistent -y
  rm -rf /etc/iptables
  

  Install nftables​

  apt update
  apt install nftables -y
  
  Main configuration file:
  /etc/nftables.conf
  

  Create a base nftables firewall​

  Edit the file:
  nano /etc/nftables.conf
  
  Example configuration for DjangoPBX / FreeSWITCH:
  #!/usr/sbin/nft -f
  
  
  flush ruleset
  
  
  table inet filter {
  chain input {
  type filter hook input priority 0;
  policy drop;
  
  
  iif lo accept
  ct state established,related accept
  
  
  tcp dport 22 accept
  tcp dport {80,443} accept
  
  
  udp dport 5060 accept
  tcp dport 5060 accept
  udp dport 16384-32768 accept
  
  
  ip protocol icmp accept
  }
  
  
  chain forward {
  type filter hook forward priority 0;
  policy drop;
  }
  
  
  chain output {
  type filter hook output priority 0;
  policy accept;
  }
  }
  
  
  
  

  ---

  
  

  Apply and test the rules​

  nft -f /etc/nftables.conf
  nft list ruleset
  
  Verify:
  
  
  • SSH access
  • DjangoPBX web interface
  • SIP registration
  • RTP audio flow
• 
  

  ---

  
  

  Enable nftables at boot​

  systemctl enable nftables
  systemctl start nftables
  
  
  Result
  • Debian 12 running native nftables
  • Persistent and secure firewall
  • Fully compatible with DjangoPBX + FreeSWITCH
  • No iptables dependency
  • Ideal setup for IONOS VPS

enjoy
Leave your feedback if this was helpful.

 

[Adrian Fretwell]

Just be aware that using the nftables rule set above, will mean that non of the counters or sets that DjangoPBX interacts with will be available. Any firewall related activity will fail. For example, when someone requests too many URLs that do not exist, their IP address is automatically put into a web block list, this operation will fail if the list is not configured in the firewall.