Skip to main content

Linux Firewall Generator (UFW, Iptables & Nftables)

Generate production Linux server firewall rulesets for UFW, iptables, and /etc/nftables.conf with SSH rate-limiting and trusted subnet whitelisting.

Input Parameters

Try Example:
165535
165535

Calculation Results

Default Inbound Traffic Policy
DROP
WAN Network Interface
eth0
SSH Service Port
22
Active Port Rules Count
4 Rules
Exposed Service Ports Summary
22/tcp, 80/tcp, 443/tcp, 51820/udp
Firewall Security Posture (EN)
High (Zero-Trust Default DROP + SSH Anti-BruteForce Rate-Limit Active)
Want to compare 2 design options side-by-side (e.g., Scenario A vs Scenario B)?
⚡ Production Security & Ops Standard
Debian 12 / Ubuntu 24.04 LTS + Nftables + Systemd Timer
CIS Benchmark Level 1 • Non-Root SSH Key-Only + Fail2ban/CrowdSec

Validate firewall rulesets and cron timers in staging before production rollout.

Firewall Filter Rules Summary Table
Service NamePort / ProtocolAllowed Source IPFilter Action
SSH Remote Admin22/tcp0.0.0.0/0 (Any)LIMIT (Anti-BruteForce)
HTTP Web Server80/tcp0.0.0.0/0 (Any)ALLOW
HTTPS TLS Web Server443/tcp0.0.0.0/0 (Any)ALLOW
WireGuard VPN Tunnel51820/udp0.0.0.0/0 (Any)ALLOW
UFW Command Script (Ubuntu / Debian)
# === UFW (Uncomplicated Firewall) Configuration ===
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp comment 'SSH with brute-force rate limit'
sudo ufw allow 80/tcp comment 'HTTP Web'
sudo ufw allow 443/tcp comment 'HTTPS TLS Web'
sudo ufw allow 51820/udp comment 'WireGuard VPN'
sudo ufw --force enable
sudo ufw status verbose
Linux Iptables Rules Script
#!/usr/bin/env bash
# === Linux iptables Stateful Firewall Rules (eth0) ===
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback and established/related connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT
# SSH (22/tcp) with brute-force protection (max 6 connections / 60s)
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_BRUTE
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --name SSH_BRUTE -j DROP
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
Modern Nftables Configuration (/etc/nftables.conf)
#!/usr/sbin/nft -f
# === Modern Linux nftables Configuration (/etc/nftables.conf) ===
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif "lo" accept
    ct state established,related accept
    ct state invalid drop
    ip protocol icmp icmp type echo-request limit rate 5/second accept
    ip6 nexthdr icmpv6 accept
    tcp dport 22 ct state new limit rate 6/minute burst 10 packets accept
    tcp dport { 80, 443 } ct state new accept
    udp dport 51820 accept
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}
Multi-Vendor CLI & Packet Flow

Multi-Vendor Config Translator & Interactive Packet Flow Visualizer

Interactive Packet Flow Pipeline (Click Stage to Inspect)WAN ➔ Prerouting/NAT ➔ Filter/QoS ➔ LAN
1. Network Interfaceeth0 / ens182. Conntrack & Drop Invct state invalid drop3. SSH Rate-Limit & ACLTCP :22 + 10.10.10.0/244. Allowed Services / DTCP 80, 443 ACCEPT
1. Network Interface: Ingress packets hit NIC; loopback (lo) and ESTABLISHED/RELATED sessions pass immediately.
# MikroTik RouterOS v7 — Equivalent Input/Forward Hardening Filter
/ip firewall address-list
add list=TRUSTED_MGMT address=10.10.10.0/24
/ip firewall filter
add chain=input connection-state=established,related,untracked action=accept
add chain=input connection-state=invalid action=drop
add chain=input src-address-list=TRUSTED_MGMT action=accept comment="Allow Management Subnet"
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=SSH_STAGE2 action=add-src-to-address-list address-list=SSH_BLACKLIST address-list-timeout=1d
add chain=input protocol=tcp dst-port=22 src-address-list=!SSH_BLACKLIST action=accept comment="Rate-Limited SSH"
add chain=input protocol=tcp dst-port=80,443 action=accept comment="Allow HTTP/HTTPS"
add chain=input in-interface-list=!LAN action=drop comment="Default Drop Input"
Share to WhatsApp
ℹ️

Technical Accuracy Note: Calculation results are engineering estimates based on standard RFC/IEEE/ITU-T models. Actual field performance may vary due to protocol overhead, hardware specifications, and environmental factors.

🚀 Share Calculation Results or Embed on Your Site

Deep-link automatically preserves your current inputs — ideal for WhatsApp, Telegram, Reddit, or engineering docs.

How to Use This Tool

  1. Select the default inbound policy (DROP recommended), specify the WAN interface name, custom SSH port, and enable SSH rate-limiting protection.
  2. Toggle the public and administrative services to expose (HTTP/HTTPS, WireGuard, Proxmox, or database ports restricted to a trusted management subnet).
  3. Copy the generated UFW commands, iptables script, or /etc/nftables.conf block and apply them on your server with console access ready.

Worked Example: Production Web Server + WireGuard VPN (SSH Port 2222)

Worked example: A default DROP policy on eth0 with SSH port 2222 (rate-limited), HTTP 80, HTTPS 443, and WireGuard 51820/udp generates 5 explicit rules while isolating management ports.

Example Input
Default Inbound Policy
DROP (Silent Drop — Production Recommended)
WAN Network Interface Name
eth0
SSH Server TCP Port
2222
Enable SSH Brute-Force Rate-Limiting
Yes / Active
Allow HTTP Web Server (Port 80/TCP)
Yes / Active
Allow HTTPS TLS Web Server (Port 443/TCP)
Yes / Active
Allow WireGuard VPN Tunnel (UDP)
Yes / Active
WireGuard UDP Port
51820
Allow Proxmox VE Web GUI (Port 8006/TCP from Trusted Subnet)
No / Inactive
Allow MySQL/PostgreSQL (3306 & 5432 from Trusted Subnet)
No / Inactive
Trusted Management Subnet (CIDR)
10.10.10.0/24
Allow ICMP Echo Request Diagnostics (Ping)
Yes / Active
Calculated Output
Default Inbound Traffic Policy
DROP
WAN Network Interface
eth0
SSH Service Port
2222
Active Port Rules Count
4 Rules
Exposed Service Ports Summary
2222/tcp, 80/tcp, 443/tcp, 51820/udp
Firewall Security Posture (EN)
High (Zero-Trust Default DROP + SSH Anti-BruteForce Rate-Limit Active)
UFW Command Script (Ubuntu / Debian)
# === UFW (Uncomplicated Firewall) Configuration === sudo ufw --force reset sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw limit 2222/tcp comment 'SSH with brute-force rate limit' sudo ufw allow 80/tcp comment 'HTTP Web' sudo ufw allow 443/tcp comment 'HTTPS TLS Web' sudo ufw allow 51820/udp comment 'WireGuard VPN' sudo ufw --force enable sudo ufw status verbose
Linux Iptables Rules Script
#!/usr/bin/env bash # === Linux iptables Stateful Firewall Rules (eth0) === iptables -F iptables -X iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT # Allow loopback and established/related connections iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT # SSH (2222/tcp) with brute-force protection (max 6 connections / 60s) iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW -m recent --set --name SSH_BRUTE iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --name SSH_BRUTE -j DROP iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW -j ACCEPT iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT iptables -A INPUT -p udp --dport 51820 -j ACCEPT
Modern Nftables Configuration (/etc/nftables.conf)
#!/usr/sbin/nft -f # === Modern Linux nftables Configuration (/etc/nftables.conf) === flush ruleset table inet filter { chain input { type filter hook input priority 0; policy drop; iif "lo" accept ct state established,related accept ct state invalid drop ip protocol icmp icmp type echo-request limit rate 5/second accept ip6 nexthdr icmpv6 accept tcp dport 2222 ct state new limit rate 6/minute burst 10 packets accept tcp dport { 80, 443 } ct state new accept udp dport 51820 accept } chain forward { type filter hook forward priority 0; policy drop; } chain output { type filter hook output priority 0; policy accept; } }
Firewall Filter Rules Summary Table
Service NamePort / ProtocolAllowed Source IPFilter Action
SSH Remote Admin2222/tcp0.0.0.0/0 (Any)LIMIT (Anti-BruteForce)
HTTP Web Server80/tcp0.0.0.0/0 (Any)ALLOW
HTTPS TLS Web Server443/tcp0.0.0.0/0 (Any)ALLOW
WireGuard VPN Tunnel51820/udp0.0.0.0/0 (Any)ALLOW

Core Concept & Engineering Notes

Host-level firewalls in Linux operating systems operate directly on top of the in-kernel Netfilter subsystem to inspect, filter, and manipulate network packets traversing physical or virtual interfaces. Across the evolution of enterprise Linux distributions, administrators rely on three primary management layers interacting with Netfilter: iptables as the classic table-and-chain command-line utility, nftables as the modern unified replacement introduced in Linux kernel 3.13 that consolidates IPv4 and IPv6 rulesets under the unified inet family, and UFW (Uncomplicated Firewall) as a declarative front-end abstraction widely deployed on Debian and Ubuntu servers. Foundational server hardening relies on a strict default-deny (drop) posture for all unsolicited inbound traffic while permitting outbound traffic initiated by the host. Through stateful packet inspection powered by the kernel connection tracking module (conntrack), the firewall monitors the lifecycle of every active socket session. Packets belonging to established or related sessions (ESTABLISHED, RELATED) are accepted immediately at the top of the input chain, whereas malformed packets (INVALID) are dropped early before consuming application-layer compute resources. Beyond exposing essential public endpoints such as HTTP (80/tcp), HTTPS (443/tcp), and WireGuard VPN tunnels (51820/udp), administrative and database ports require strict source-subnet whitelisting and connection rate limiting. Applying stateful rate limits on SSH endpoints mitigates automated credential brute-force attacks by throttling or dropping source IP addresses that exceed the allowed threshold of new TCP handshakes per minute. When deploying firewall rulesets across bare-metal hypervisors or cloud instances, engineers must also preserve loopback interface (lo) traffic, essential ICMP control messages, and container bridge compatibility. Indiscriminately blocking all ICMP packets breaks Path MTU Discovery (PMTUD) in IPv4 and Neighbor Discovery Protocol (NDP) in IPv6, causing silent TCP connection stalls during large TLS handshakes or bulk transfers. Permitting rate-limited ICMP echo requests while restricting sensitive management consoles—such as Proxmox VE (8006/tcp) or SQL database listeners—exclusively to trusted VPN subnets establishes a defense-in-depth perimeter without degrading transport-layer diagnostics.

How It Was Calculated (Formulas & Steps)

Frequently Asked Questions (FAQ)

What is the main difference between iptables and nftables in modern Linux?

Nftables unifies IPv4 and IPv6 filtering under a single 'inet' table family, applies ruleset updates atomically, and evaluates sets of ports or IP addresses with lower CPU overhead than sequential iptables chains.

Why must the SSH allow rule be added before running ufw enable?

If the default input policy is set to DROP or UFW is enabled before permitting the active SSH port, administrators will be locked out of subsequent remote SSH sessions.

How does ufw limit work on an SSH port?

The ufw limit directive denies new TCP connection attempts from a single source IP address if that host initiates 6 or more connection attempts within a 30-second window.

Does Docker modify iptables and UFW rules directly?

Yes. The Docker daemon inserts rules into the PREROUTING and DOCKER-USER chains. To filter published container ports (-p), apply restrictions in the DOCKER-USER chain or bind containers to 127.0.0.1.

Related Calculators

View All Linux & DevOps Tools →
Linux Chmod File Permissions Calculator (Octal & Symbolic)

Convert Linux chmod octal (755, 644, 4750) and symbolic (-rwxr-xr-x) permissions, calculate umask, audit 777 security risks, and view breakdown tables.

Linux Cron Job Expression & Crontab Schedule Generator

POSIX 5-field cron expression generator, production crontab line builder, next 5 execution timestamps, and systemd timer unit converter.

Linux Swap Size, Swappiness & Ext4 Inode Calculator

Calculate optimal Linux swap size, vm.swappiness, vm.vfs_cache_pressure sysctl tunables, default ext4 inode count, and /swapfile creation script.

Multi-Timezone Maintenance Window & Cron Planner

Plan server maintenance windows across WIB, WITA, WIT, SGT, and UTC timezones with automated cron backup conflict detection and change notice.

Docker, Nginx & Linux Stack Visual Composer

Visually compose production container stacks: select Nginx/Cloudflare ingress, frontend, backend API, databases & Redis. Generates SVG topology, docker-compose.yml, and UFW scripts.

Complete Linux & DevOps Directory →

References & Notes

Last updated: Technically Verified · Industry Standard

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.

🔗Related Scenarios & Companion Calculators

Browse All 30+ Scenarios →

🛠️ Sibling Calculators in this Category:

Linux Cron Job Expression & Crontab Schedule Generator

POSIX 5-field cron expression generator, production crontab line builder, next 5 execution timestamps, and systemd timer unit converter.

Linux Chmod File Permissions Calculator (Octal & Symbolic)

Convert Linux chmod octal (755, 644, 4750) and symbolic (-rwxr-xr-x) permissions, calculate umask, audit 777 security risks, and view breakdown tables.

Linux Swap Size, Swappiness & Ext4 Inode Calculator

Calculate optimal Linux swap size, vm.swappiness, vm.vfs_cache_pressure sysctl tunables, default ext4 inode count, and /swapfile creation script.

Multi-Timezone Maintenance Window & Cron Planner

Plan server maintenance windows across WIB, WITA, WIT, SGT, and UTC timezones with automated cron backup conflict detection and change notice.

🔬 Scientific Methodology & Normative Verification

Engineering Sensitivity Analysis, Response Curve & Technical Citation

✓ Calibrated to ISO/IEC/IEEE/TIA Clauses

1. 1. 3-Point Engineering Sensitivity & Tolerance Envelope

Comparative evaluation across theoretical laboratory bounds (0% loss), current nominal operating point, and conservative field safety bounds (±15% thermal/aging derating).

Evaluated Parameter Ideal Theoretical Bound Nominal Operating Point Conservative Safety Bound (±15%) Engineering Derating Rule
SSH Service Port 19.8 22 25.3 Engineering Safety Margin (+15% Overhead)
Active Port Rules Count 3.6 4 4.6 Engineering Safety Margin (+15% Overhead)

2. 2. Mathematical Function Curve & Operating Coordinate (x₀, y₀)

MATHEMATICAL RESPONSE CURVE: SSH SERVICE PORT VS SSH SERVICE PORT Conservative Engineering Bound (+15% Safety Margin) 8.8 13.2 17.6 22 26.4 30.8 35.2 (x₀=22, y₀=22) Variabel Independen (x): SSH Service Port

3. 3. Physical Constants & Normative Standard Clauses

R_loop(Cat6, 20°C) = 14 Ω/100m ANSI/TIA-568.2-D & IEEE 802.3bt

DC Loop Resistance for 23 AWG Solid Copper Cat6

Clause 6.4.1 / Table 145-1 — Nominal 23 AWG solid copper loop resistance at 20°C is 14.0 Ω/100m (TIA maximum ceiling is 18.8 Ω/100m).

α_opt(1490nm) = 0.25 dB/km ITU-T Rec. G.652.D & G.984.2

Single-Mode Optical Fiber Attenuation Coefficient at 1490 nm

Table 1 / Class B+ & C+ Optical Path — Typical G.652.D attenuation at 1490 nm downstream is 0.22–0.25 dB/km (1310 nm upstream: 0.35 dB/km).

α_Cu(20°C) = 0.00393 °C⁻¹ IEC 60028

Temperature Coefficient of Resistance for Copper

International Annealed Copper Standard — Used in thermal derating equation: R(T) = R_20 × [1 + 0.00393 × (T - 20)].

4. 4. Independent Technical & Academic Citation (IEEE / APA 7th / BibTeX / LaTeX)

Use the standard citation formats below to reference this computational methodology in engineering specifications, audit reports, or academic papers.

Format IEEE & APA 7th Edition

[IEEE] KalkuNet Engineering Team, "Linux Firewall Generator (UFW, Iptables & Nftables) — Standard Engineering Computational Instrument," KalkuNet Technical Suite, 2026. [Online]. Available: https://kalkunet.com/en/tools/linux-firewall-generator. [Accessed: 2026-11-08].

[APA 7th] KalkuNet Engineering Team. (2026). Linux Firewall Generator (UFW, Iptables & Nftables) (Production release 2026-11-08) [Engineering computational software]. KalkuNet. https://kalkunet.com/en/tools/linux-firewall-generator

BibTeX & LaTeX Derivation Snippet
@software{kalkunet_linux_firewall_generator_2026,
  author = {{KalkuNet Engineering Team}},
  title = {{Linux Firewall Generator (UFW, Iptables & Nftables) --- KalkuNet Engineering Suite}},
  year = {2026},
  publisher = {KalkuNet.com},
  url = {https://kalkunet.com/en/tools/linux-firewall-generator},
  urldate = {2026-11-08}
}

% LaTeX Engineering Derivation — Generated via https://kalkunet.com/en/tools/linux-firewall-generator
\begin{equation}
  \text{Model: } Stateful Filtering Principle: Accept ct state { established, related }, drop ct state invalid, and enforce default DROP on the INPUT chain.
\end{equation}
% Parameter Input Terukur: defaultPolicy = drop, \; wanInterface = eth0, \; sshPort = 22, \; sshRateLimit = true
% Hasil Evaluasi Numerik : defaultIncomingPolicy = \mathbf{DROP}, \; wanInterface = \mathbf{eth0}, \; sshPort = \mathbf{22}