Ferm is a Iptables front-end tool. Ferm allows you to configure your Iptables firewall in easy to read structured configuration files without need of write complex Iptables rules.
How to install ferm
Ferm is available as a package for Debian and other distributions. Check the official website.
If you want to install ferm from source just download it from ferm website, extract it and run:
Configuration file language
Ferm makes things simple:
chain (INPUT OUTPUT) {
proto (udp tcp) ACCEPT;
}
This will insert 4 rules, 2 in chain input and 2 in chain output, matching and accepting both udp and tcp packets.
In Iptables you would have to do a bit more typing 
iptables -A INPUT -p tcp -j ACCEPT
iptables -A OUTPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp -j ACCEPT
iptables -A OUTPUT -p udp -j ACCEPT
The C like structure is easy to understand and You can use variables, functions and test (if else).
You can read more about those in ferm manual.
Example configuration file (ferm.conf)
# Interfaces
@def $DEV_LOCAL = lo;
@def $DEV_LAN = eth1;
@def $DEV_INTERNET = eth0;
# Ports
@def $PORTS = (ftp http);
# Known IPs
@def $SSH_ALLOWED = (195.111.25.61 95.155.41.172);
@def $SSH_DYNDNS = @resolve((joe.dyndns.com joe2.homelinux.net));
# SSH Clients
@def $SSH_CLIENTS = ($SSH_ALLOWED $SSH_DYNDNS);
table filter {
chain INPUT {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# allow local connections
interface $DEV_LOCAL ACCEPT;
interface $DEV_LAN ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# our services to the world
proto tcp dport $PORTS ACCEPT;
# SSH log and accept
saddr $SSH_CLIENTS proto tcp dport ssh ACCEPT;
# the rest is dropped by the above policy
}
# outgoing connections are not limited
chain OUTPUT policy ACCEPT;
# this is not a router
chain FORWARD policy DROP;
}
This configuration file will set default INPUT policy to DROP and allow unrestricted connections on http and ftp ports + restricted connections to SSH for listed IPs.
Running ferm
To load your rules:
