IPTables & UFW Firewall Rule Generator

Name: Wespner
Address: CZ
Price range: €€

Build a rule set with allow/deny, direction, protocol and ports — get back a complete, ready-to-apply iptables ruleset or ufw script. IPv6 is mirrored automatically, and we warn you before a rule set would lock out SSH.

Rule builder

What should the firewall do

Add one row per rule. Rules are evaluated top to bottom — order matters, see the note below.

Action	Direction	Protocol	Port / range	Source / remote IP	Remove

1. Allow inbound TCP port 22 (SSH) from anywhere

Default policy

What happens to traffic with no matching rule

A deny-by-default inbound policy plus explicit allow rules is the standard, safest baseline.

Default inbound policy

Default outbound policy

Forward traffic is always dropped — these rule sets are for a single host, not a router.

Rules are evaluated in order, top to bottom.

A deny rule placed above an allow rule it would otherwise match wins — that allow rule is never reached. Put broad deny rules at the bottom, or make them more specific.

Presets

Common setups, one click

Commonly-used defaults — a given server may run on different ports, so treat these as a starting point and confirm against your own config.

General

Game servers

Output

Ready-to-apply ruleset

Two files: rules.v4 for IPv4 (iptables) and rules.v6 for IPv6 (ip6tables), mirroring the same rules.

/etc/iptables/rules.v4

#!/usr/sbin/iptables-restore
# Wespner Firewall Rule Generator — IPv4 rules
# Save as /etc/iptables/rules.v4 and load with:
#   iptables-restore < /etc/iptables/rules.v4
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Loopback traffic is always trusted
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# Keep already-open connections flowing (stateful firewall)
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Rule 1: Allow inbound TCP port 22 (SSH) from anywhere
-A INPUT -p tcp --dport 22 -j ACCEPT

COMMIT

/etc/iptables/rules.v6

#!/usr/sbin/ip6tables-restore
# Wespner Firewall Rule Generator — IPv6 rules
# Save as /etc/iptables/rules.v6 and load with:
#   ip6tables-restore < /etc/iptables/rules.v6
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Loopback traffic is always trusted
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# Keep already-open connections flowing (stateful firewall)
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Rule 1: Allow inbound TCP port 22 (SSH) from anywhere
-A INPUT -p tcp --dport 22 -j ACCEPT

COMMIT

Applying and persisting it

sudo apt install iptables-persistent netfilter-persistent
sudo iptables-restore < /etc/iptables/rules.v4
sudo ip6tables-restore < /etc/iptables/rules.v6
sudo netfilter-persistent save

Running your own game server?

Wespner game servers with DDoS protection, NVMe drives and activation within minutes.

Browse hosting