Firewall Rule Generator

Firewall Configuration Guide

A firewall controls network traffic by enforcing rules that allow or deny connections based on IP addresses, ports, and protocols. On Linux servers, iptables (legacy) and nftables (modern replacement) are the standard kernel-level packet filters. UFW provides a simpler interface on top of iptables for Ubuntu/Debian systems. Cloud providers offer their own abstractions: AWS Security Groups, Azure NSGs, and GCP Firewall Rules.

Linux Firewall Comparison

Cloud Firewall Comparison

Common Ports Reference

iptables Packet Flow & Chain Architecture

Understanding how packets traverse iptables chains is essential for writing correct rules. Packets follow different paths depending on whether they're destined for the local machine, being forwarded (routed), or originating from the local machine:

Incoming Packet
      │
      ▼
 PREROUTING (nat, mangle) ─── Destination NAT (DNAT), port forwarding
      │
      ├── For local machine? ──▶ INPUT (filter) ──▶ Local Process
      │                                              │
      └── For another host? ──▶ FORWARD (filter) ──────┐
                                                        │
                                                        ▼
Local Process ──▶ OUTPUT (filter, nat) ──▶ POSTROUTING (nat, mangle)
                                                        │
                                       ◀────────────────┘
                                                        │
                                                        ▼
                                                  Network (out)

Key rules:
• Firewall rules for server services → INPUT chain
• Firewall rules for routed traffic → FORWARD chain (routers, Docker hosts)
• NAT rules (port forwarding) → PREROUTING + POSTROUTING
• Outbound filtering → OUTPUT chain (rarely needed)

In nftables, the same concepts apply but chains are user-defined. You create chains with explicit types (type filter hook input) instead of the fixed chain names.

iptables vs nftables: Syntax Comparison

nftables replaces iptables with a cleaner syntax and better performance. Here are the same rules written in both formats:

Key nftables advantages: atomic ruleset updates (replace entire ruleset in one operation), unified IPv4/IPv6 (inet family handles both), sets and maps (match against lists without multiple rules), and better performance (fewer kernel modules).

Docker & iptables: The DOCKER-USER Chain

Docker modifies iptables rules automatically, which can bypass your INPUT chain rules. When you publish a port (-p 8080:80), Docker adds DNAT rules in PREROUTING and FORWARD chain rules that bypass INPUT entirely.

# Problem: This rule does NOT block Docker-published ports!
iptables -A INPUT -p tcp --dport 8080 -j DROP  # Useless for Docker ports

# Solution: Use the DOCKER-USER chain (processed before Docker's rules)
iptables -I DOCKER-USER -p tcp --dport 8080 -s 0.0.0.0/0 -j DROP
iptables -I DOCKER-USER -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT

# Allow only specific IPs to access Docker-published ports
iptables -I DOCKER-USER -i eth0 -j DROP
iptables -I DOCKER-USER -i eth0 -s 10.0.0.0/8 -j RETURN
iptables -I DOCKER-USER -i eth0 -p tcp --dport 80 -j RETURN
iptables -I DOCKER-USER -i eth0 -p tcp --dport 443 -j RETURN

# Persist DOCKER-USER rules (they survive Docker restarts)
# Create a systemd service that loads rules on boot

This is the most common Docker security mistake: administrators add INPUT chain rules thinking they protect Docker services, but published ports are routed through the FORWARD chain. Always use DOCKER-USER for firewall rules on Docker hosts. Alternatively, bind ports to 127.0.0.1 and use a reverse proxy.

Common Firewall Mistakes

IPv6 Support

This generator fully supports IPv6 addresses and CIDR ranges. Enter IPv6 CIDRs like 2001:db8::/32, fe80::1/64, or ::/0 (all IPv6) in source/destination fields. For iptables, IPv6 rules are automatically output as ip6tables commands with essential ICMPv6 rules included. For nftables, the inet family handles both IPv4 and IPv6 in a single ruleset. UFW and cloud formats (AWS, Azure, GCP) pass IPv6 CIDRs through natively. The conflict detection engine correctly handles IPv6 range overlap analysis.

Privacy First

All rules are generated entirely in your browser using JavaScript. Your IP addresses, subnets, and infrastructure details are never sent to any server. This tool has zero backend dependencies.