What do you use for firewall management across many boxes?

You just saved me a weekend. I assumed it was too old. Will test on the ancient box this week.

It does not, in my experience. Their web-based "reinstall" lets you pick an ISO and that's it. No user-data, no iPXE. Hetzner's robot API is much better for this, but I'm not moving 25 Contabo boxes over pricing.

Efficiency argument: maintaining 40 individual firewalls is already inefficient. The correct answer is a single point of control, which means either overlay network with centralized policy or accepting that your "edge nodes" should be dumb proxies behind a proper firewall pair. I run two pfSense VMs at Hetzner Nuremberg — https://www.hetzner.com/cloud — everything else connects via WireGuard. The edge nodes have literally two rules: allow WireGuard, allow loopback. Cost is two Hetzner CX21s at ~9 EUR each. My time is worth more than that.

PfSense in a VM. In 2024. With WireGuard, which pfSense only added in CE 2.6.0 and still half-breaks on reboot if you don't script the interface assignment. I rest my case about abstraction over abstraction. Just run OpenBSD with pf directly on the host and be done with it.

Has anyone actually used CrowdSec on this kind of mixed fleet? I know it's not firewall management per se but the bouncer integrates with iptables/nftables/firewalld. The shared threat intel means if one box sees a scanner, all 40 block it. I'm testing it on 5 Hetzner boxes, seems solid. The local API is lightweight.

You know I looked at CrowdSec. You know the local API needs postgres or sqlite and you know that's another thing to back up. You know I just fail2ban and sleep fine. You know maybe I'm the problem.

Following this thread because I'm about to inherit a similar mess — 30+ boxes at InterServer Secaucus and some stragglers at a place I'd rather not name. The previous admin used SaltStack which I've never touched. From what I'm reading here, the ansible route seems more hireable? More people know it? That's worth something when you're the one getting paged.

Salt is actually great for this, the reactor system means a minion can trigger firewall updates on peers. But the community shrank after the VMware acquisition and the documentation rotted. Ansible won the mindshare war. If you're inheriting Salt, my condolences — you'll be reading 2018 blog posts to figure out why

salt-ssh

What about Tailscale's ACLs? I know it's not traditional firewall management but for "what ports can reach what" it's declarative, version-controlled, and works across all three providers without touching iptables directly. The free tier covers 20 users, unlimited devices. Your 40 nodes would fit. The catch: all traffic goes through WireGuard, which adds latency. Fine for management, maybe not for customer-facing edge.

I actually use Tailscale for my own access to the fleet, but the edge nodes serve public traffic — CDN origins, game servers, some UDP stuff. Can't tunnel that. The ACLs are nice for the admin layer though.

To summarize what I'm taking from this thread:
- Test nftables on the Debian 10 box (thanks @ana_mad)
- Look harder at standardizing on nftables + simple push, maybe drop the ansible galaxy role
- pfSense/centralized is tempting but adds SPOF and complexity
- CrowdSec worth a pilot on the Hetzner subset

Still no silver bullet. Appreciate all the war stories.