Skip to content
ToolMug

Use ↑ ↓ to move, Enter to open, Esc to close.

Firewall Rule Generator

Open the ports your server needs and close the rest without looking up three different syntaxes. Pick a starting template, list ports, protocols and source addresses, and copy the commands for ufw (Ubuntu, Debian), firewalld (RHEL, Rocky, AlmaLinux) or plain iptables. The generator orders block rules before allow rules and warns you if the rules would cut off your own SSH connection.

Runs in your browser — nothing you enter is uploaded

Start from:

Inbound rules

Run as root. ufw enable asks for confirmation; check the list with ufw status numbered.

Block rules are placed before allow rules, because all three firewalls apply the first rule that matches. Cloud servers often also have a security group in the provider’s console; ports must be open there too.

How to use

  1. Choose a template, such as Web server (SSH, HTTP, HTTPS), or edit the rules directly.
  2. For each rule, enter ports, the protocol, the source address (leave empty for anywhere) and Allow or Block.
  3. Set your SSH port and decide whether to block all other incoming traffic.
  4. Pick your firewall and copy the commands into a root shell on the server.

Options explained

Ports
A single port (22), a list (80,443) or a range (8000-8100).
From
An IPv4 or IPv6 address or network, such as 203.0.113.0/24. IPv6 sources go to ip6tables.
Block all other incoming traffic
Sets the default incoming policy to deny. Outgoing traffic stays allowed.

Example output

Three rules, with SSH on port 22 and the default policy set to deny: allow SSH only from 203.0.113.5, allow TCP ports 80 and 443 from anywhere, and block 198.51.100.0/24 from port 25. The block rule is written first, because the first matching rule wins.

# ufw
ufw default deny incoming
ufw default allow outgoing
ufw deny from 198.51.100.0/24 to any port 25 proto tcp
ufw allow from 203.0.113.5 to any port 22 proto tcp
ufw allow 80,443/tcp
ufw enable

# iptables
iptables -A INPUT -p tcp -s 198.51.100.0/24 --dport 25 -j DROP
iptables -A INPUT -p tcp -s 203.0.113.5 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -P INPUT DROP

For firewalld, ports open to everyone use --add-port, while rules with a source or a block use a rich rule. Because the only SSH rule has a source address, the firewalld commands also remove the default ssh service from the zone. Without that step the zone would still let everyone in on port 22.

Frequently asked questions

How do I avoid locking myself out?

Keep a rule that allows your SSH port, and if you limit SSH to certain IPs, check your current IP first. Keeping the cloud provider’s web console open gives you a way back in.

I opened the port but still cannot connect. Why?

Cloud servers usually have a security group or network firewall in the provider’s console as well; the port must be open there too. Also check that the service is listening, for example with ss -tlnp.

Which firewall does my server use?

Ubuntu and Debian usually use ufw; RHEL, Rocky, AlmaLinux and CentOS use firewalld. Both are front ends for the kernel firewall, so use one of them rather than mixing in raw iptables commands.

Privacy

This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.

Related tools