Linux Firewall Rule Generator
Build syntax-perfect packet filtering rules for UFW, iptables, nftables, pf, and firewalld. Secure your servers by binding ports to specific CIDR subnets and rate-limiting connection attempts.
sudo ufw allow proto tcp from 198.51.100.0/24 to any port 22 comment 'Allow trusted management subnet'
sudo ufw status verbose
sudo ufw enable
sudo ufw delete [num]
Need to verify if your firewall rules work?
Run an external scan against your public IP to confirm that ports are properly closed or stealth filtered.
Reserved banner container configured with strict Core Web Vitals CLS = 0 layout preservation.
Comparing Linux Packet Filtering Engines: iptables vs. nftables vs. UFW
Every Linux distribution handles packet filtering in the Linux kernel via the Netfilter framework. However, the user-space utilities used to construct, load, and manage these access control lists differ dramatically across distributions:
UFW (Uncomplicated Firewall)
Default on Ubuntu and Debian. UFW acts as an intuitive front-end to iptables/nftables. Its simplified human-readable syntax prevents common configuration errors like locking oneself out of SSH.
nftables (The Modern Standard)
The official replacement for iptables in Linux kernel 3.13+. It unifies IPv4, IPv6, ARP, and bridge filtering into a single bytecode engine, providing significantly higher throughput and atomic ruleset updates.
pf (Packet Filter)
Originally written for OpenBSD and adopted by FreeBSD, macOS, and OPNsense/pfSense firewalls. Known for its elegant rule syntax, stateful connection tracking, and state-table optimization.
Essential Server Hardening Rules for Production Linux Hosts
1. Enforce Default Deny Policy
Never rely on an open-by-default firewall. In UFW, run sudo ufw default deny incoming and sudo ufw default allow outgoing. Only explicitly permitted ports will accept traffic; all other probe attempts will be silently dropped.
2. Restrict SSH & Admin by Source CIDR
Never leave Port 22 open to 0.0.0.0/0 if you have a static office IP or VPN gateway. Restricting access using from 198.51.100.0/24 completely neutralizes automated credential-stuffing and botnet brute-force scans.
3. Rate-Limit Connection Attempts
If SSH must remain open to the public internet, use UFW's built-in rate limiter: sudo ufw limit ssh/tcp. This automatically denies connections from an IP that attempts 6 or more connections within 30 seconds.
4. Keep Established Connections Alive
When handcrafting raw iptables rules, always place -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT at the very top of your INPUT chain. Failing to do so will sever your active SSH terminal the moment you apply your ruleset!
Frequently Asked Questions (FAQ)
Do iptables rules survive a server reboot?
By default, no. Raw iptables commands exist in memory only. To make them persistent across reboots on Debian/Ubuntu, install the iptables-persistent package or use UFW which automatically saves rules to disk.
What is the difference between DROP and REJECT?
DROP silently discards the packet without sending any acknowledgment, leaving port scanners hanging until they time out (Stealth/Filtered). REJECT immediately replies with a TCP RST packet or ICMP destination unreachable message, revealing that the host is active.
How do I test if my rule works without getting locked out?
Always keep a secondary SSH session open in another terminal window while applying firewall changes. You can also run an external check using our Inbound Port Checker to verify that the port is responding as intended.
Should I use firewalld or UFW on Red Hat/CentOS?
On RHEL, CentOS Stream, Rocky Linux, and Fedora, firewalld is the native dynamic firewall daemon that integrates with NetworkManager. Use the firewalld tab above to generate rich rules for these enterprise systems.