🛡️ Iptables Rule Generator

🎯 Preset

Pick a curated starting point. The form fields below repopulate when you switch presets.

⚖️ Default chain policies

INPUT (traffic to this host)

FORWARD (traffic through this host)

OUTPUT (traffic leaving this host)

🔧 Common rules

📜 Rules

No rules. Click "Add rule" to insert one.

Chain

Protocol

Source IP / CIDR

Action

Destination IP / CIDR

Src port

Dest port (e.g. 22 / 80,443 / 1000:2000)

Interface (e.g. eth0)

NAT target (DNAT: IP:port, SNAT: IP)

Comment

{{ visibleOutput || '# Configure policies and rules on the left to generate output.' }}

📂 Suggested file paths

{{ f.name }} → {{ f.path }}

⚠️ Warnings

{{ w }}

📖 Rule-by-rule explanation

{{ e.rule }} {{ e.meaning }}

⚠️

ℹ️ About Iptables Rule Generator

What this generator builds

This tool emits two interchangeable firewall scripts for Linux: an iptables-restore file that loads into the legacy iptables framework, and the equivalent nftables ruleset for the modern nft command. Both speak to the kernel's Netfilter subsystem; nftables is the long-term successor and consolidates the iptables / ip6tables / arptables / ebtables tool family behind a single binary.

Use the form on the left to set chain policies, add explicit ACCEPT/DROP/REJECT rules per chain, configure NAT (SNAT, DNAT, MASQUERADE) for routers and port-forwarding, allow loopback and established connections, and log packets that fall through. The generator inspects your input and surfaces warnings for the common foot-guns — like a restrictive INPUT policy without an SSH allow rule, or DNAT without the kernel's net.ipv4.ip_forward sysctl turned on.

Chains, tables, and policies (quick reference)

INPUT — packets addressed to the local machine. Hardens the host firewall.
OUTPUT — packets generated locally and leaving the host. Used for egress filtering.
FORWARD — packets passing through the host (routers, gateways, bridges).
PREROUTING — NAT table: packets entering before routing decisions. Used for DNAT (port forwarding).
POSTROUTING — NAT table: packets leaving after routing decisions. Used for SNAT and MASQUERADE.
Default policy — applied when no rule matches. DROP is the safe choice on INPUT/FORWARD for servers.

Actions / targets

ACCEPT — allow the packet to continue.
DROP — silently drop the packet (no response).
REJECT — drop the packet and send an ICMP "destination unreachable" reply.
LOG — write a kernel log line. Does NOT stop the packet — pair with a follow-up rule.
DNAT — rewrite destination address/port. Only useful in PREROUTING.
SNAT — rewrite source address. Only useful in POSTROUTING.
MASQUERADE — like SNAT but uses the outgoing interface's primary address; ideal for dial-up / DHCP egress.

Common pitfalls

SSH lockout — switching INPUT policy to DROP without first ACCEPTing port 22 will lock you out of a remote machine. The generator flags this scenario.
Loopback drop — restrictive INPUT policy with no -i lo ACCEPT rule breaks every local socket. Enable "Allow loopback".
Established connections — without conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT, replies to outbound traffic are dropped. Enable "Allow established".
DNAT without ip_forward — port forwarding fails silently unless net.ipv4.ip_forward=1 is set in sysctl.
MASQUERADE on every interface — without -o <wan> the rule masquerades on every NIC, which often breaks internal routing.
SSH open to 0.0.0.0/0 — allowing port 22 from the entire internet exposes brute-force attempts. Restrict to a management subnet whenever possible.

iptables vs nftables

iptables is the legacy interface (Linux 2.4+). Most distributions still ship it via iptables-nft, a shim that compiles iptables syntax into nftables expressions under the hood. Direct iptables syntax remains universally understood by operators and CI tooling, so this generator emits both formats simultaneously and lets you copy whichever matches the target host.

nftables uses a unified, expressive syntax (chain input { type filter hook input priority filter; policy drop; }) and is the long-term direction for Linux firewalling. New deployments should prefer the nftables output; this generator's nftables block stores rules in the inet family (combined IPv4 + IPv6) for the filter table, and in ip nat for the NAT tables.

Source references

Netfilter project documentation — canonical home of iptables / nftables / conntrack.
nftables wiki — syntax reference and migration guides from iptables.
iptables-extensions(8) — official match/target extension reference.
iptables(8) man page — historical man page with chain semantics.

API Usage Example:

POST /api/tools/linux/iptables-rule-generator
Content-Type: application/json

{
    "defaults": {
        "input": "DROP",
        "forward": "DROP",
        "output": "ACCEPT"
    },
    "allowLoopback": true,
    "allowEstablished": true,
    "rules": [
        {
            "chain": "INPUT",
            "protocol": "tcp",
            "destinationPort": "22",
            "action": "ACCEPT",
            "ruleComment": "Allow SSH"
        }
    ]
}