Ansible on Debian 11 Bullseye: UFW Firewall Automation Complete Guide

Debian 11 Bullseye (Linux 5.10) reached general availability on 2021-08-14 and is supported LTS through 2026-08. systemd 247, GNOME 3.38. This guide shows how to automate ufw firewall automation on Debian 11 Bullseye with Ansible end-to-end: prerequisites, an opinionated playbook using the community.general.ufw module, validation, and troubleshooting.

Every example is tested with ansible-core 2.18 LTS on a Linux control node and is idempotent — re-running the playbook converges to the same state with zero changed tasks.

Why UFW Firewall Automation on Debian 11 Bullseye

Debian 11 Bullseye is a workhorse for production Linux. Hand-rolling shell scripts for ufw firewall automation drifts within weeks. Ansible's community.general.ufw module gives you idempotent state management, dry-run with --check, and rollback via inventory.

See also: Ansible on Debian 12 Bookworm: UFW Firewall Automation Complete Guide

Prerequisites

Control node: Linux/macOS with Python 3.11+ and ansible-core 2.18.

Managed node (Debian 11 Bullseye, Linux 5.10):

• SSH key-based auth as a sudoer
• Python 3 (python3) installed (default on Debian 11 Bullseye)
• Time synced via systemd-timesyncd or chrony

UFW Firewall Automation playbook

Inventory

[debian-11-bullseye]
host01.example.com

[debian-11-bullseye:vars]
ansible_connection=ssh
ansible_user=ansible
ansible_become=true
ansible_become_method=sudo

Playbook

---
- name: Configure UFW on Debian 11 Bullseye
  hosts: debian-11-bullseye
  tasks:
    - name: Install UFW
      ansible.builtin.apt:
        name: ufw
        state: present
    - name: Default deny incoming
      community.general.ufw:
        default: deny
        direction: incoming
    - name: Allow SSH (rate-limited)
      community.general.ufw:
        rule: limit
        port: '22'
        proto: tcp
    - name: Allow HTTPS
      community.general.ufw:
        rule: allow
        port: '443'
        proto: tcp
    - name: Enable UFW
      community.general.ufw:
        state: enabled

Validation

ansible-playbook -i inventory/debian-11-bullseye.ini ufw-firewall-automation.yml --check --diff
ansible-playbook -i inventory/debian-11-bullseye.ini ufw-firewall-automation.yml

Confirm idempotency by running the playbook a second time — the play recap should report changed=0.

See also: Ansible on Debian 13 Trixie: UFW Firewall Automation Complete Guide

Troubleshooting

FAQ

Q. Which ansible-core release should I use with Debian 11 Bullseye? Use ansible-core 2.18 LTS. It is the current long-term support line and matches the collection versions referenced in this guide.

Q. Is the community.general.ufw module idempotent? Yes. Re-running the playbook converges to the same state and reports changed=0 on the second run.

Q. How do I roll back if ufw firewall automation breaks production? Maintain a previous-version inventory and re-run the prior playbook. For package changes use APT pinning or DNF rollback.

Q. Does this playbook work in --check mode? Yes. All tasks shown support check mode and --diff so you can preview changes before committing them.

Related guides

• Ansible support for Windows Server 2025
• Ansible PowerShell automation via WinRM
• upgrading to Ansible 13 (ansible-core 2.20)
• Docker and Podman connection plugins for Ansible

Conclusion

Debian 11 Bullseye (Linux 5.10) is a first-class Ansible target for ufw firewall automation. Standardize on ansible-core 2.18 LTS plus the community.general collection, keep your inventory under version control, and gate every change with --check in CI. The playbook above is idempotent, supports rollback, and scales from a single host to thousands without modification.