Linux iptables & UFW Rule Generator

Generate secure iptables, UFW, and nftables firewall rules with stateful connection tracking and rate limiting — entirely on this device.

0 bytes uploaded

Default Traffic Policies

Default Incoming (INPUT):

Default Outgoing (OUTPUT):

Hardening & Protection Modules

Allow Loopback Traffic (lo)Allow Established & Related ConnectionsSYN-Flood Rate Limiting ProtectionSSH Brute-Force Rate Limiting (recent module)Drop Malformed / Invalid PacketsAllow Rate-Limited ICMP Ping

Inbound Port Rules

Quick presets:

#!/usr/bin/env bash # Stateful iptables firewall ruleset - Generated by Developer Utility SaaS # https://devxcode.com/iptables-generator set -euo pipefail # 1. Flush existing rules and delete custom chains iptables -F iptables -X iptables -t nat -F || true iptables -t mangle -F || true # 2. Set default policies iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT # 3. Allow loopback interface traffic iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # 4. Allow established and related connections iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # 5. Drop invalid malformed packets iptables -A INPUT -m conntrack --ctstate INVALID -j DROP # 6. SYN-flood rate-limiting protection iptables -N SYN_FLOOD iptables -A INPUT -p tcp --syn -j SYN_FLOOD iptables -A SYN_FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A SYN_FLOOD -j DROP # 7. Allow ICMP echo-request (ping) with rate limit iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 4 -j ACCEPT # 8. SSH brute-force protection (max 4 new connections per minute) iptables -N SSH_PROTECT iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j SSH_PROTECT iptables -A SSH_PROTECT -m recent --set --name SSH_RATELIMIT iptables -A SSH_PROTECT -m recent --update --seconds 60 --hitcount 4 --name SSH_RATELIMIT -j DROP iptables -A SSH_PROTECT -j ACCEPT # 9. Inbound port filtering rules iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT # 10. Persist rules across reboots (Debian/Ubuntu: netfilter-persistent, RHEL: iptables-services) # netfilter-persistent save || service iptables save

Do it offline:$

How to use it

Choose default traffic policies for incoming (INPUT) and outgoing (OUTPUT) traffic (default DROP for incoming is recommended).
Toggle core security protection modules: Loopback (lo), Established/Related connection tracking (conntrack), SYN flood mitigation, and SSH rate-limiting.
Add inbound port rules for your application services (HTTP, HTTPS, SSH, databases, WireGuard VPN).
Optionally restrict sensitive ports (like database or admin endpoints) to specific trusted source CIDR subnets.
Switch between iptables Bash script, UFW commands, and nftables syntax, then copy the configuration to your server.

Build stateful Linux firewall rulesets with default DROP policies, loopback allowances, conntrack connection tracking, SYN-flood rate-limiting, and multi-format exports for iptables, UFW, and modern nftables.

How it works

Linux netfilter inspects network packets using kernel hooks. iptables and modern nftables allow configuring packet filtering tables (filter, nat, mangle).

A secure stateful firewall starts with default DROP on INPUT and FORWARD chains, only permitting explicitly whitelisted inbound ports.

The conntrack module (-m conntrack --ctstate ESTABLISHED,RELATED) allows inbound packets belonging to existing outgoing connections (such as curl requests or package updates) without needing to open random high ports.

The recent module tracks connection frequency to mitigate automated SSH password brute-forcing by dropping rapid successive connection attempts.

Examples

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

Common errors

FAQ

What is the difference between DROP and REJECT in iptables?

DROP silently discards the packet with zero response to the sender, making the host appear unresponsive and slowing down automated port scanners. REJECT actively replies with an ICMP 'port unreachable' or TCP RST packet, immediately informing the client that the port is closed.

How do I make iptables rules persistent across reboots?

On Debian/Ubuntu systems, install iptables-persistent and run 'sudo netfilter-persistent save'. On RHEL/CentOS systems, use 'sudo service iptables save' or configure firewalld / nftables persistent services.

Should I use iptables or UFW?

UFW (Uncomplicated Firewall) is a simplified frontend wrapper designed for Debian/Ubuntu systems that generates iptables/nftables rules under the hood. For standard servers, UFW commands are easier to audit and manage, while raw iptables or nftables scripts offer granular control over custom chains, rate limits, and packet mangling.

Nothing you paste here leaves this tab. State only ever travels in links you explicitly create.

Last reviewed: 2026-10-09