Firewall Rule Generator
Describe which ports to open, for which protocol and from where, and get the same rules for ufw, nftables, iptables or firewalld.
Free · No sign-up · Your inputs stay in your browser
Input
Generate firewall rules
Output
Rules
239 characters
Allow SSH before enabling a default-deny policy, from a second session you keep open, or you lock yourself out. Docker publishes container ports by writing its own iptables rules ahead of ufw's, so a -p 5432:5432 is reachable from the internet even with ufw denying it; bind such ports to 127.0.0.1.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Default deny, then open what is needed
A server usually needs SSH from known addresses and HTTP and HTTPS from anywhere, plus UDP 443 for HTTP/3. Everything else, the database, Redis, an admin panel, should be reachable only on a private network. Add the SSH rule before turning on a default-deny policy, from a second session you keep open, so a mistake does not lock you out.
Docker bypasses ufw
Docker writes its own iptables rules for published ports, and they are evaluated before ufw's, so -p 5432:5432 is reachable from the internet even with ufw denying 5432. Bind such ports to 127.0.0.1 (-p 127.0.0.1:5432:5432), as the Docker packet filtering docs describe.