KDE Plasma Firewall: Simple GUI for UFW and Firewalld

KDE Plasma does not include a built-in firewall GUI, but you can manage UFW or firewalld through simple graphical tools like Firewall Applet (plasma-firewall) or the standalone Gufw and Firewall-config apps. This article explains the options, how they work, and which one to choose for your Plasma desktop.

Background: Firewalls on Linux Desktops

Linux distributions typically ship with one of two firewall backends: UFW (Uncomplicated Firewall) or firewalld. UFW is a front-end for iptables/nftables, popular on Ubuntu and Debian-based systems. Firewalld is the default on Fedora, RHEL, and openSUSE, and it uses zones to manage rules dynamically. Both are command-line tools by default; a GUI is not included with the base install.

KDE Plasma itself has no native firewall module in System Settings. However, the KDE project maintains a small applet called Firewall Applet (package name plasma-firewall) that provides a system tray icon and a minimal interface for controlling firewalld or UFW. For more complete configuration, you can install a standalone GUI like Gufw (for UFW) or firewall-config (for firewalld).

How the Firewall Applet Works

The Firewall Applet integrates with Plasma’s system tray. Once installed and running, it shows the current firewall status (active/inactive) and lets you toggle it on or off with a click. It also provides a simple settings dialog where you can allow or block incoming traffic for common services, and it can open the full configuration tool if you have one installed.

Under the hood, the applet talks to the firewall backend through the system’s D-Bus interface. For firewalld, it uses the firewalld D-Bus API; for UFW, it uses the ufw command-line tool with root privileges. The applet does not replace the full configuration tools—it is designed for quick status checks and basic toggling.

Installing a GUI for UFW: Gufw

If your distribution uses UFW, the most straightforward GUI is Gufw (Graphical Uncomplicated Firewall). It is a GTK-based application, but it runs fine on Plasma. To install it:

On Ubuntu/Debian: sudo apt install gufw
On Arch: sudo pacman -S gufw
On Fedora: sudo dnf install gufw (if enabled in RPM Fusion)

Gufw provides a simple on/off switch, preset profiles (Home, Public, Office), and a rule editor where you can allow or deny specific ports, IP addresses, or applications. It is ideal for users who want a point-and-click way to manage UFW without touching the terminal.

Using Firewall-config for Firewalld

For firewalld, the official GUI is firewall-config. It is a Python/GTK application that lets you manage zones, services, ports, and rich rules. Install it with:

Fedora: sudo dnf install firewall-config
openSUSE: sudo zypper install firewall-config
Ubuntu (if using firewalld): sudo apt install firewall-config

Firewall-config shows a list of zones (e.g., public, home, internal) and allows you to assign network interfaces to them. You can add services like SSH or HTTP, open custom ports, and even define rich rules with logging. It is more powerful than Gufw but still accessible for beginners.

Choosing Between UFW and Firewalld

The choice is usually dictated by your distribution. If you are on Ubuntu or Debian, UFW is the default and Gufw is the simplest path. If you are on Fedora or RHEL, firewalld is the default and firewall-config is the natural companion. You can install both backends on the same system, but running both simultaneously can cause conflicts—stick to one.

For Plasma users, the Firewall Applet works with both, so you can keep the tray icon regardless of backend. If you need advanced features like zone-based rules or dynamic updates, firewalld is more flexible. If you just want to block incoming traffic by default and allow a few ports, UFW is simpler.

Common Problems and Solutions

Firewall Applet not showing in tray: Ensure the package is installed and the plasmoid is enabled. Right-click the tray, select “Configure System Tray,” and check that “Firewall” is listed and visible.
Gufw won’t start: It requires root privileges. Run it from the application menu; if it fails, try launching from terminal with gksu gufw or pkexec gufw.
firewall-config says “not authorized”: You need to be in the wheel group or use polkit rules. Running with pkexec firewall-config usually works.
Rules not applying after reboot: Ensure the firewall service is enabled. For UFW: sudo systemctl enable ufw. For firewalld: sudo systemctl enable firewalld.

Alternatives and Advanced Options

Besides Gufw and firewall-config, there are other GUIs. Firetools is a GUI for Firejail, which is a sandboxing tool, not a firewall. KMyFirewall is an older KDE app that manages iptables directly, but it is not actively maintained. For advanced users, the command line remains the most powerful way to configure nftables or iptables, but the GUIs cover most desktop needs.

If you prefer a web-based interface, some routers offer firewall configuration, but that is for network-level filtering, not host-based. On Plasma, you can also use Plasma’s Firewall Applet in combination with a backend GUI—the applet gives quick status, and the full tool gives detailed control.

Frequently Asked Questions

Is there a built-in firewall GUI in KDE Plasma?

No, KDE Plasma does not include a firewall GUI by default. You need to install a separate package like Gufw, firewall-config, or the Firewall Applet (plasma-firewall).

Can I use Gufw on Fedora with Plasma?

Yes, Gufw can be installed on Fedora, but it requires enabling RPM Fusion repository. However, since Fedora uses firewalld by default, it is easier to use firewall-config instead.

Does the Firewall Applet support both UFW and firewalld?

Yes, the Firewall Applet detects which backend is active and controls it accordingly. It shows a simple on/off toggle and basic status, but for detailed rules you still need the full GUI.

How do I open a specific port with Gufw?

In Gufw, click “Add” and choose “Port.” Enter the port number, select TCP or UDP, and choose “Allow.” Then click “Apply” to save the rule.

Is it safe to disable the firewall on a desktop Linux?

If your system is behind a home router with NAT, the risk is lower, but it is still recommended to keep a firewall enabled, especially if you connect to public Wi-Fi or run services like SSH. Disabling it exposes all open ports to the network.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →