SanchitGurukulSG iptables Command Generator

SanchitGurukul Networking & Security Tools

iptables Command Generator

Build firewall, forwarding and NAT commands with validation, explanations and practical examples.

Linux Firewall

Remote-server warning: a wrong firewall rule can immediately disconnect SSH or expose services. Keep a second session open, test rules before saving, and confirm console access.

1. Choose rule type

IP family Table Operation Chain Rule position Action / target

2. Match traffic

Protocol Source IP / CIDR Destination IP / CIDR Source port Destination port Incoming interface Outgoing interface Connection state TCP flags preset ICMP type

3. Optional controls

Rate limit Limit burst Log prefix Log level Comment Reject response

Generated command

Ready

# Select options and generate a command.

Command explanation

Your rule explanation will appear here.

Policy and rule-management commands

Persistence: iptables rules are normally lost after reboot unless saved through your distribution's firewall service, such as iptables-persistent or netfilter-persistent.

Practical examples

Select an example to load every relevant field into the generator.

How iptables evaluates rules

A packet enters a table and chain appropriate to its path.
Rules are tested from top to bottom.
The first terminating target such as ACCEPT, DROP or REJECT decides the result.
If no rule matches, the chain policy applies.

Common chains

Chain	Purpose
INPUT	Traffic destined for the local machine.
OUTPUT	Traffic generated by the local machine.
FORWARD	Traffic routed through the machine.
PREROUTING	Packets before the routing decision; commonly DNAT.
POSTROUTING	Packets after routing; commonly SNAT or MASQUERADE.

Important safety practices

Allow established traffic before applying restrictive default policies.
Allow your current SSH source before changing INPUT to DROP.
Use -C to check for duplicates before appending automation-managed rules.
List numbered rules before deletion: sudo iptables -L INPUT --line-numbers -n -v.
For modern systems, verify whether iptables uses the nftables backend.

Your feedback matters

Was this post helpful?

2 reactions