Linux Firewall Generator (UFW, Iptables & Nftables)

Generate production Linux server firewall rulesets for UFW, iptables, and /etc/nftables.conf with SSH rate-limiting and trusted subnet whitelisting.

Input Parameters

Try Example:

Calculation Results

Default Inbound Traffic Policy: DROP
WAN Network Interface: eth0
SSH Service Port: 22
Active Port Rules Count: 4 Rules
Exposed Service Ports Summary: 22/tcp, 80/tcp, 443/tcp, 51820/udp
Firewall Security Posture (EN): High (Zero-Trust Default DROP + SSH Anti-BruteForce Rate-Limit Active)

Want to compare 2 design options side-by-side (e.g., Scenario A vs Scenario B)?

⚡ Production Security & Ops Standard

Debian 12 / Ubuntu 24.04 LTS + Nftables + Systemd Timer

CIS Benchmark Level 1 • Non-Root SSH Key-Only + Fail2ban/CrowdSec

Validate firewall rulesets and cron timers in staging before production rollout.

Firewall Filter Rules Summary Table

Service Name	Port / Protocol	Allowed Source IP	Filter Action
SSH Remote Admin	22/tcp	0.0.0.0/0 (Any)	LIMIT (Anti-BruteForce)
HTTP Web Server	80/tcp	0.0.0.0/0 (Any)	ALLOW
HTTPS TLS Web Server	443/tcp	0.0.0.0/0 (Any)	ALLOW
WireGuard VPN Tunnel	51820/udp	0.0.0.0/0 (Any)	ALLOW

UFW Command Script (Ubuntu / Debian)

# === UFW (Uncomplicated Firewall) Configuration ===
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp comment 'SSH with brute-force rate limit'
sudo ufw allow 80/tcp comment 'HTTP Web'
sudo ufw allow 443/tcp comment 'HTTPS TLS Web'
sudo ufw allow 51820/udp comment 'WireGuard VPN'
sudo ufw --force enable
sudo ufw status verbose

Linux Iptables Rules Script

#!/usr/bin/env bash
# === Linux iptables Stateful Firewall Rules (eth0) ===
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback and established/related connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT
# SSH (22/tcp) with brute-force protection (max 6 connections / 60s)
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_BRUTE
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --name SSH_BRUTE -j DROP
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p udp --dport 51820 -j ACCEPT

Modern Nftables Configuration (/etc/nftables.conf)

#!/usr/sbin/nft -f
# === Modern Linux nftables Configuration (/etc/nftables.conf) ===
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif "lo" accept
    ct state established,related accept
    ct state invalid drop
    ip protocol icmp icmp type echo-request limit rate 5/second accept
    ip6 nexthdr icmpv6 accept
    tcp dport 22 ct state new limit rate 6/minute burst 10 packets accept
    tcp dport { 80, 443 } ct state new accept
    udp dport 51820 accept
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}

Multi-Vendor CLI & Packet Flow

Multi-Vendor Config Translator & Interactive Packet Flow Visualizer

Interactive Packet Flow Pipeline (Click Stage to Inspect)WAN ➔ Prerouting/NAT ➔ Filter/QoS ➔ LAN

1. Network Interface: Ingress packets hit NIC; loopback (lo) and ESTABLISHED/RELATED sessions pass immediately.

# MikroTik RouterOS v7 — Equivalent Input/Forward Hardening Filter
/ip firewall address-list
add list=TRUSTED_MGMT address=10.10.10.0/24
/ip firewall filter
add chain=input connection-state=established,related,untracked action=accept
add chain=input connection-state=invalid action=drop
add chain=input src-address-list=TRUSTED_MGMT action=accept comment="Allow Management Subnet"
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=SSH_STAGE2 action=add-src-to-address-list address-list=SSH_BLACKLIST address-list-timeout=1d
add chain=input protocol=tcp dst-port=22 src-address-list=!SSH_BLACKLIST action=accept comment="Rate-Limited SSH"
add chain=input protocol=tcp dst-port=80,443 action=accept comment="Allow HTTP/HTTPS"
add chain=input in-interface-list=!LAN action=drop comment="Default Drop Input"

Share to WhatsApp

How to Use This Tool

Select the default inbound policy (DROP recommended), specify the WAN interface name, custom SSH port, and enable SSH rate-limiting protection.
Toggle the public and administrative services to expose (HTTP/HTTPS, WireGuard, Proxmox, or database ports restricted to a trusted management subnet).
Copy the generated UFW commands, iptables script, or /etc/nftables.conf block and apply them on your server with console access ready.

Worked Example: Production Web Server + WireGuard VPN (SSH Port 2222)

Worked example: A default DROP policy on eth0 with SSH port 2222 (rate-limited), HTTP 80, HTTPS 443, and WireGuard 51820/udp generates 5 explicit rules while isolating management ports.

Example Input

Default Inbound Policy: DROP (Silent Drop — Production Recommended)
WAN Network Interface Name: eth0
SSH Server TCP Port: 2222
Enable SSH Brute-Force Rate-Limiting: Yes / Active
Allow HTTP Web Server (Port 80/TCP): Yes / Active
Allow HTTPS TLS Web Server (Port 443/TCP): Yes / Active
Allow WireGuard VPN Tunnel (UDP): Yes / Active
WireGuard UDP Port: 51820
Allow Proxmox VE Web GUI (Port 8006/TCP from Trusted Subnet): No / Inactive
Allow MySQL/PostgreSQL (3306 & 5432 from Trusted Subnet): No / Inactive
Trusted Management Subnet (CIDR): 10.10.10.0/24
Allow ICMP Echo Request Diagnostics (Ping): Yes / Active

Calculated Output

Default Inbound Traffic Policy: DROP
WAN Network Interface: eth0
SSH Service Port: 2222
Active Port Rules Count: 4 Rules
Exposed Service Ports Summary: 2222/tcp, 80/tcp, 443/tcp, 51820/udp
Firewall Security Posture (EN): High (Zero-Trust Default DROP + SSH Anti-BruteForce Rate-Limit Active)
UFW Command Script (Ubuntu / Debian): # === UFW (Uncomplicated Firewall) Configuration === sudo ufw --force reset sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw limit 2222/tcp comment 'SSH with brute-force rate limit' sudo ufw allow 80/tcp comment 'HTTP Web' sudo ufw allow 443/tcp comment 'HTTPS TLS Web' sudo ufw allow 51820/udp comment 'WireGuard VPN' sudo ufw --force enable sudo ufw status verbose
Linux Iptables Rules Script: #!/usr/bin/env bash # === Linux iptables Stateful Firewall Rules (eth0) === iptables -F iptables -X iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT # Allow loopback and established/related connections iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT # SSH (2222/tcp) with brute-force protection (max 6 connections / 60s) iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW -m recent --set --name SSH_BRUTE iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --name SSH_BRUTE -j DROP iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW -j ACCEPT iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT iptables -A INPUT -p udp --dport 51820 -j ACCEPT
Modern Nftables Configuration (/etc/nftables.conf): #!/usr/sbin/nft -f # === Modern Linux nftables Configuration (/etc/nftables.conf) === flush ruleset table inet filter { chain input { type filter hook input priority 0; policy drop; iif "lo" accept ct state established,related accept ct state invalid drop ip protocol icmp icmp type echo-request limit rate 5/second accept ip6 nexthdr icmpv6 accept tcp dport 2222 ct state new limit rate 6/minute burst 10 packets accept tcp dport { 80, 443 } ct state new accept udp dport 51820 accept } chain forward { type filter hook forward priority 0; policy drop; } chain output { type filter hook output priority 0; policy accept; } }

Firewall Filter Rules Summary Table

Service Name	Port / Protocol	Allowed Source IP	Filter Action
SSH Remote Admin	2222/tcp	0.0.0.0/0 (Any)	LIMIT (Anti-BruteForce)
HTTP Web Server	80/tcp	0.0.0.0/0 (Any)	ALLOW
HTTPS TLS Web Server	443/tcp	0.0.0.0/0 (Any)	ALLOW
WireGuard VPN Tunnel	51820/udp	0.0.0.0/0 (Any)	ALLOW

Core Concept & Engineering Notes

Host-level firewalls in Linux operating systems operate directly on top of the in-kernel Netfilter subsystem to inspect, filter, and manipulate network packets traversing physical or virtual interfaces. Across the evolution of enterprise Linux distributions, administrators rely on three primary management layers interacting with Netfilter: iptables as the classic table-and-chain command-line utility, nftables as the modern unified replacement introduced in Linux kernel 3.13 that consolidates IPv4 and IPv6 rulesets under the unified inet family, and UFW (Uncomplicated Firewall) as a declarative front-end abstraction widely deployed on Debian and Ubuntu servers. Foundational server hardening relies on a strict default-deny (drop) posture for all unsolicited inbound traffic while permitting outbound traffic initiated by the host. Through stateful packet inspection powered by the kernel connection tracking module (conntrack), the firewall monitors the lifecycle of every active socket session. Packets belonging to established or related sessions (ESTABLISHED, RELATED) are accepted immediately at the top of the input chain, whereas malformed packets (INVALID) are dropped early before consuming application-layer compute resources. Beyond exposing essential public endpoints such as HTTP (80/tcp), HTTPS (443/tcp), and WireGuard VPN tunnels (51820/udp), administrative and database ports require strict source-subnet whitelisting and connection rate limiting. Applying stateful rate limits on SSH endpoints mitigates automated credential brute-force attacks by throttling or dropping source IP addresses that exceed the allowed threshold of new TCP handshakes per minute. When deploying firewall rulesets across bare-metal hypervisors or cloud instances, engineers must also preserve loopback interface (lo) traffic, essential ICMP control messages, and container bridge compatibility. Indiscriminately blocking all ICMP packets breaks Path MTU Discovery (PMTUD) in IPv4 and Neighbor Discovery Protocol (NDP) in IPv6, causing silent TCP connection stalls during large TLS handshakes or bulk transfers. Permitting rate-limited ICMP echo requests while restricting sensitive management consoles—such as Proxmox VE (8006/tcp) or SQL database listeners—exclusively to trusted VPN subnets establishes a defense-in-depth perimeter without degrading transport-layer diagnostics.

How It Was Calculated (Formulas & Steps)

Mathematical Formulas

Stateful Filtering Principle: Accept ct state { established, related }, drop ct state invalid, and enforce default DROP on the INPUT chain.
SSH Rate-Limiting: Throttle new TCP SYN handshakes to a maximum of 6 attempts per 30–60 seconds per source IP.
Management & Database Isolation: Restrict ports 8006, 3306, and 5432 exclusively to the trusted management CIDR block.

Step-by-Step Calculation

1. Kebijakan Default Inbound: DROP pada interface eth0 dengan pelacakan status koneksi stateful (ESTABLISHED, RELATED).
2. Proteksi Port Manajemen SSH: Port 22/tcp dilindungi dengan pembatasan laju (rate-limiting maksimal 6 koneksi baru per 60 detik).
3. Total Port Layanan Terbuka: 4 port (22/tcp, 80/tcp, 443/tcp, 51820/udp).
4. Menghasilkan aturan ekuivalen untuk UFW (Ubuntu/Debian), iptables klasik, dan nftables modern (Kernel Linux 5.x/6.x).

Frequently Asked Questions (FAQ)

What is the main difference between iptables and nftables in modern Linux?

Nftables unifies IPv4 and IPv6 filtering under a single 'inet' table family, applies ruleset updates atomically, and evaluates sets of ports or IP addresses with lower CPU overhead than sequential iptables chains.

Why must the SSH allow rule be added before running ufw enable?

If the default input policy is set to DROP or UFW is enabled before permitting the active SSH port, administrators will be locked out of subsequent remote SSH sessions.

How does ufw limit work on an SSH port?

The ufw limit directive denies new TCP connection attempts from a single source IP address if that host initiates 6 or more connection attempts within a 30-second window.

Does Docker modify iptables and UFW rules directly?

Yes. The Docker daemon inserts rules into the PREROUTING and DOCKER-USER chains. To filter published container ports (-p), apply restrictions in the DOCKER-USER chain or bind containers to 127.0.0.1.

View All Linux & DevOps Tools →

Linux Chmod File Permissions Calculator (Octal & Symbolic)

Convert Linux chmod octal (755, 644, 4750) and symbolic (-rwxr-xr-x) permissions, calculate umask, audit 777 security risks, and view breakdown tables.

Linux Cron Job Expression & Crontab Schedule Generator

POSIX 5-field cron expression generator, production crontab line builder, next 5 execution timestamps, and systemd timer unit converter.

Linux Swap Size, Swappiness & Ext4 Inode Calculator

Calculate optimal Linux swap size, vm.swappiness, vm.vfs_cache_pressure sysctl tunables, default ext4 inode count, and /swapfile creation script.

Multi-Timezone Maintenance Window & Cron Planner

Plan server maintenance windows across WIB, WITA, WIT, SGT, and UTC timezones with automated cron backup conflict detection and change notice.

Complete Linux & DevOps Directory →

References & Notes

Last updated: 2026-11-07Technically Verified · Industry Standard

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.