Firewall Rule Generator

A new server on the internet receives login attempts within minutes. A host firewall that only accepts the ports you actually serve is the simplest protection, but the three common front ends, ufw, iptables and nftables, each have their own syntax. This generator keeps one list of rules and writes it for whichever firewall your system uses.

Policies and order

A firewall decides what to do with traffic in two steps. Rules are checked in order and the first match wins; traffic that matches no rule gets the default policy. The safe pattern for a server is a default of “deny incoming, allow outgoing” with explicit allow rules for the services you run, so anything you forget stays closed. Put specific deny rules above broad allow rules, or they will never be reached.

One list, three outputs

ufw, the Uncomplicated Firewall on Ubuntu, gets one readable command per rule, such as sudo ufw allow from 10.0.0.0/24 to any port 5432 proto tcp, followed by enabling it. iptables gets rules for the INPUT chain, starting with the two everyone needs: accept packets that belong to established connections and accept the loopback interface. nftables gets a complete ruleset in an inet table, which covers IPv4 and IPv6 at once, with port lists written as sets like { 80, 443 }.

Rate limiting SSH

Choosing “Rate-limit” for a port turns on brute-force protection. In ufw that is the limit action, which denies an address after six connection attempts within 30 seconds. In iptables the recent module counts new connections per source, and in nftables a limit rate expression caps new connections per minute. Legitimate users rarely notice; password-guessing bots slow to a crawl.

Sources, ports and protocols

Leave the source empty to match any address, or enter a single IP or a CIDR range such as 192.0.2.0/24 to allow only an office or private network. Ports can be single numbers, comma-separated lists or ranges like 8000-8100. “Both” writes the rule for TCP and UDP, which suits services such as DNS on port 53.

A worked example

The Sample rules rate-limit SSH, allow web traffic on 80 and 443, allow PostgreSQL only from 10.0.0.0/24 and block one address. In ufw form the output starts with sudo ufw default deny incoming and sudo ufw default allow outgoing, then sudo ufw limit from any to any port 22 proto tcp comment "SSH, rate-limited", the allow rules and sudo ufw deny from 203.0.113.7, and ends with sudo ufw enable. Switching to nftables gives a chain with policy drop; and the line tcp dport { 80, 443 } accept comment "Web".

Applying rules safely

Changing a firewall over SSH can cut your own connection. Keep the current session open, apply the rules, and test logging in from a second terminal before closing the first. The tool warns when a default-deny policy is on and no rule allows port 22. On cloud servers, a provider console or security group gives you a way back in if something goes wrong.

Things to know

Docker publishes container ports by writing its own iptables rules, which bypass ufw, so publish ports on 127.0.0.1 when they should stay private. The iptables output covers IPv4; repeat it with ip6tables or use nftables for IPv6. Cloud firewalls and security groups are a separate layer that also needs the right ports.

Related tools

• SSH Config Generator sets up key-based logins to the server.
• Nginx Config Generator configures the web server behind ports 80 and 443.
• Chmod Calculator locks down key and config files.
• systemd Unit Generator runs the services the firewall exposes.