Firewall Rule Generator

About the Firewall Rule Generator

A server firewall should refuse every incoming connection except the few it is there for. Writing that by hand means remembering a different syntax for each firewall — and one wrong line can lock you out of your own server. Fill in the form once: SSH (from anywhere, or only from your own addresses, with a per-address limit on new connections), web ports and any other ports, ping, IPv6, and whether refused traffic is dropped or rejected. The generator writes the same policy for UFW, iptables (rules.v4 and rules.v6), nftables, firewalld, Windows Defender Firewall (PowerShell), pf, AWS security groups, Google Cloud firewall rules and Azure network security groups.

Every line is explained in a comment, the parts each firewall cannot express are listed under the rules, and Apply safely gives the steps that test the rules first and undo them by themselves if you lose access — iptables-apply, a timed systemd-run rollback, firewalld’s runtime configuration, a scheduled task on Windows or at for pf. Paste your current iptables-save output under Explain existing iptables rules to get every rule in plain words and the usual mistakes pointed out.

Without a pass you see a free preview: the warnings and notes in full, the first lines of each rules file and of the Apply safely steps, and the first rows of the explanation of existing rules. The full rules and steps, and copying or downloading them, unlock with a Pro pass.

Common uses

• Locking down a new VPS or cloud server: SSH from your own address, web ports for everyone.
• Moving a server from iptables to nftables, or from UFW to firewalld, with the same policy.
• Writing matching cloud security group rules and a host firewall for defence in depth.
• Reviewing an inherited server’s iptables rules before changing them.
• Opening a database or admin port only to the application network.

What every ruleset contains

• Default deny for incoming traffic and for routing, while outgoing traffic is allowed.
• Loopback and replies to the server’s own connections (connection tracking: ESTABLISHED, RELATED), without which DNS lookups and updates fail.
• The ICMP errors that keep connections working, and for IPv6 neighbour discovery from the local link (hop limit 255, RFC 4861) and packet-too-big — dropping all ICMPv6 breaks IPv6 (RFC 4890).
• DHCP and DHCPv6 replies, for servers that get their addresses that way, as UFW’s own rules do.
• Your services, each limited to the addresses you give, then optional rate-limited logging and, if chosen, a reject reply (TCP reset or ICMP unreachable) instead of a silent drop.

Rate limits per address

Each address may open only so many new connections a minute; replies and connections already open are not affected. iptables uses the hashlimit match, nftables a dynamic set with a limit per address (nftables wiki), pf max-src-conn-rate with an overload table that blocks the offender (pf.conf(5)). UFW’s limit is fixed: 6 connections within 30 seconds (ufw(8)). firewalld’s rule limits count every source together, so the page does not use them; Windows Firewall and the cloud firewalls have no rate limit — the notes say so, and fail2ban on the host covers it.

Applying without locking yourself out

• Work from a second session, and keep the one you are in open: connections already open are tracked as established and keep working.
• iptables: iptables-restore --test checks a file, and iptables-apply loads it and restores the old rules unless you confirm in time.
• nftables: nft -c -f checks the file; a copy of the old ruleset is restored by a systemd-run --on-active timer unless you stop it.
• UFW: rules can be added while it is off; a timer runs ufw disable unless you cancel it.
• firewalld: changes without --permanent are runtime only, so a reload restores the saved rules (firewall-cmd).
• Windows: netsh advfirewall export saves the policy and a scheduled task imports it back unless you delete the task.
• pf: pfctl -nf parses without loading, and an at job loads the old file. Cloud: add the new rules first, test, then remove the old, wider ones.

Things to know per firewall

• Docker publishes container ports in the nat table, before the INPUT rules of UFW or iptables see them; filter container traffic in the DOCKER-USER chain (Docker documentation). Loading a whole iptables table or nft flush ruleset also removes Docker’s rules until Docker restarts.
• Use one firewall manager: UFW, firewalld or your own iptables/nftables files, not several.
• AWS security groups only allow, are stateful and start with no inbound rules (AWS). Google Cloud rules hold either IPv4 or IPv6 ranges, cannot pick ICMP types, and the default network ships rules that open SSH, RDP and ping to everyone (Google Cloud). Azure NSG priorities run from 100 to 4096 and the default rules allow all traffic from inside the virtual network (Azure).
• Windows rules are created with New-NetFirewallRule in one group, so Remove-NetFirewallRule -Group takes them all away again.

Limitations

• Inbound filtering for a single host: no NAT, port forwarding, routing between networks or outbound restrictions.
• The rules are generated from the documented syntax and checked against each firewall’s documentation, but your system may differ: always run the test step first.
• The explainer reads iptables (iptables-save, iptables -S and iptables commands), not nftables or other firewalls’ rules; uncommon match modules are named but not explained.
• Cloud outputs use placeholders (sg-0123456789abcdef0, NETWORK, RESOURCE_GROUP, NSG_NAME) that you replace with your own names.

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.