MB Networks
CFG-10 · Security
Firewall rule builder
Build allow/deny rules once, get the equivalent nftables ruleset, iptables commands, and ufw commands — pick whichever your distro actually uses.
nftables ruleset
Every ruleset here includes an accept rule for established/related connections and loopback traffic — without both, a deny-by-default policy can lock out replies to your own outbound connections.
Why "established, related" has to come before your deny-everything policy
A stateful firewall tracks connections, not just packets — the reply to a connection you initiated needs to be let back in even under a deny-by-default inbound policy, or nothing that talks to the outside world (DNS lookups, package updates, the SSH session you're using right now) works at all. That accept rule always goes first, before any deny logic, in every ruleset this tool generates.
nftables, iptables, and ufw are three layers, not three choices
ufw is a friendly frontend that writes iptables rules for you; nftables is the newer kernel packet-filtering framework that's replacing iptables on most current distros (iptables-nft is a compatibility shim over it). Pick whichever your distro ships with and actually manages day to day — running two of the three unmanaged on the same box is how rules silently stop matching what you think is active.
Do I need a rule for loopback traffic?
Yes — many local services (a database a web app connects to on the same machine, some monitoring agents) communicate over the loopback interface, and a strict default-deny policy blocks that too without an explicit accept rule for lo. It's included by default in every ruleset here.
What's the difference between iptables and iptables-nft?
Modern distros ship iptables-nft — the same familiar iptables command syntax, but translated into nftables rules under the hood rather than the legacy netfilter backend. The commands you type are identical either way; only the kernel machinery underneath differs.
Why allow a port range instead of listing every port?
A range (e.g. 60000-61000) is one rule instead of a thousand — useful for things like passive FTP or an application with a documented dynamic port range. For a handful of unrelated ports, separate rules or a comma list are usually clearer to read later.
Related tools
DevOps
Crontab to systemd Timer Converter
Convert a crontab line into a systemd .service + .timer pair, including the two-OnCalendar-line trick for cron's day-of-month/day-of-week OR behavior. No account, nothing leaves your browser.
Open →DevOps
Docker Compose Generator
Build a valid Docker Compose file from a form — services, images, ports, volumes, environment variables, and restart policy. No account, nothing leaves your browser.
Open →DevOps
Dockerfile Generator
Generate a Dockerfile from a form — base image, workdir, copy and run steps, exposed ports, and an optional multi-stage build. No account, nothing leaves your browser.
Open →DevOps
.gitignore Generator
Build a merged .gitignore from language, editor, and OS templates — Node, Python, Go, Rust, Java, VSCode, JetBrains, macOS, Windows, and more. No account, nothing leaves your browser.
Open →DevOps
Kubernetes Manifest Generator
Generate a Kubernetes Deployment, Service, and optional Ingress manifest from a form — replicas, resource limits, probes, and env vars. No account, nothing leaves your browser.
Open →DevOps
Reverse Proxy Config Generator
Generate a reverse proxy config for Caddy or nginx from one form — domain, upstream, TLS, WebSocket upgrade, and security headers. No account, nothing leaves your browser.
Open →