How to use the iptables Rule Generator
- 1. Choose the defaultBlock everything not listed (recommended for servers) or allow everything not blocked.
- 2. Pick what to allowSSH (optionally from one network), web ports, other ports, ping, and IPs to block.
- 3. GenerateDownload a shell script or an iptables-restore file.
How the rules are ordered
iptables checks rules from top to bottom and stops at the first match, so order matters. The generated rules allow loopback and replies to connections the server started, drop invalid packets, block your listed addresses, then allow only the services you ticked. The SSH limit uses the recent module to drop a fifth new connection from the same IP within 60 seconds, which slows password-guessing bots. Ping is allowed but rate-limited. The shell script sets the default DROP policy last, after the allow rules are in place. Everything is calculated in your browser; nothing you enter is uploaded.
We loaded every restore-file variant with iptables-restore --test, and ran the scripts inside a throwaway network namespace and read the result back with iptables-save.
Worked example
The defaults (block by default; SSH on port 22 only from 203.0.113.0/24 with the brute-force limit; web ports 80 and 443; extra ports 3000/tcp and 53/udp; ping; and one blocked address) produce 11 rules. Incoming traffic defaults to DROP, forwarding to DROP and outgoing to ACCEPT. The restore file starts with :INPUT DROP [0:0] and ends with COMMIT.
Before you apply them
- Keep a second SSH session open, or use your cloud provider's console, so a mistake can't lock you out.
- Cloud servers also have security groups or firewalls in front; open the same ports there.
- Save the rules (for example with iptables-persistent) or they're lost on reboot.
Frequently asked questions
iptables or nftables?
Newer distributions use nftables underneath, but the iptables command still works through the iptables-nft layer, so these rules apply on both.
What about IPv6?
These are IPv4 rules. Repeat them with ip6tables if your server has a public IPv6 address.
Is the iptables generator free?
Yes. You can open the iptables generator and use every option without signing up. When you generate rules for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.