Linux Netfilter · Raw iptables · Ubuntu UFW · CIDR Filtering · Stateful Inspection

Linux iptables & UFW Firewall Generator

Visually build hardened Linux firewall scripts. Configure default drop policies, stateful session tracking, custom port rules, and subnet restrictions without locking yourself out.

Presets:

Default Chain Policies & Baseline Rules:

Default INPUT Policy:

Default FORWARD Policy:

Default OUTPUT Policy:

Allow Loopback (-i lo): Essential for local socketsESTABLISHED,RELATED: Stateful return trafficRate-limited Ping (ICMP): Diagnostic echo reply

Active Firewall Rules (4)

Rules evaluated sequentially top to bottom

Chain	Action	Proto	Port(s)	Source IP	Comment
INPUT	ACCEPT	tcp	22	Any (0.0.0.0/0)	Allow OpenSSH administration
INPUT	ACCEPT	tcp	80	Any (0.0.0.0/0)	Allow HTTP web traffic
INPUT	ACCEPT	tcp	443	Any (0.0.0.0/0)	Allow HTTPS encrypted traffic
INPUT	ACCEPT	tcp	5432	10.0.0.0/16	Allow PostgreSQL from private VPC subnet

#!/usr/bin/env bash
# SpeedDrain Generated Linux iptables Firewall Script
set -euo pipefail

# 1. Flush existing rules and reset packet counters
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -Z

# 2. Set Default Policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# 3. Allow Loopback (127.0.0.1) Traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# 4. Allow Established and Related Sessions (State Tracking)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# 5. Allow ICMP Echo Requests (Ping Diagnostics)
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/s -j ACCEPT

# 6. Custom User Rules
iptables -A INPUT -p tcp --dport 22 -m comment --comment "Allow OpenSSH administration" -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m comment --comment "Allow HTTP web traffic" -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m comment --comment "Allow HTTPS encrypted traffic" -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/16 --dport 5432 -m comment --comment "Allow PostgreSQL from private VPC subnet" -j ACCEPT

Making iptables Rules Permanent Across System Reboots:

Raw iptables rules live in kernel memory and disappear upon server reboot. To make them persistent on Debian / Ubuntu:

sudo apt install iptables-persistent
sudo netfilter-persistent save

Demystifying Linux Netfilter: iptables & UFW Architecture

01.The Three Core Filter Chains (INPUT, FORWARD, OUTPUT)

In Linux netfilter packet filtering, network packets traverse three distinct inspection checkpoints:

INPUT Chain: Packets destined for local sockets running on this machine (e.g. incoming SSH, HTTP requests hitting Nginx).
OUTPUT Chain: Packets generated locally by your applications attempting to communicate out to external servers (e.g. curl commands, apt updates).
FORWARD Chain: Packets routed through this machine to another destination (used when the Linux box acts as a router, Docker bridge, or WireGuard VPN gateway).

02.Why ESTABLISHED,RELATED is Absolutely Critical

When you set the default INPUT policy to DROP, the kernel drops all incoming packets unless explicitly allowed.

If your server makes an outbound HTTP request (e.g. running apt update), the remote server responds on a random high ephemeral port. Without connection tracking:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

the firewall would drop the returning response packets! The conntrack module recognizes that incoming packets belong to an existing session initiated by the server.

03.DROP vs. REJECT: Which Should You Choose?

When blocking unauthorized traffic, you have two primary options:

DROP (Silent Blackhole): Drops the packet into the void without sending any acknowledgment. Port scanners (like Nmap) must wait for their TCP handshake timer to timeout before proceeding. This slows down automated bot scans and hides the existence of the host.
REJECT (Polite Refusal): Sends an immediate ICMP "Port Unreachable" or TCP RST packet back to the sender. This allows internal LAN clients to fail fast rather than hanging for 30 seconds.

04.How to Avoid Locking Yourself Out of SSH

Every sysadmin has experienced the terror of executing a firewall rule and having their SSH terminal instantly freeze.

To safely test new firewall scripts:

Always specify iptables -A INPUT -p tcp --dport 22 -j ACCEPT before changing default policy to DROP.
Schedule an automatic failsafe cron job: echo "iptables -F && iptables -P INPUT ACCEPT" | at now + 5 minutes. If you get locked out, the timer will flush the firewall in 5 minutes and restore your connection!