iptables Rule Generator

What it does

Generates ready-to-use iptables command-line rules from a simple form, so you don't have to remember flag order, chain names, or match syntax every time you need to open a port, block an IP, or set up basic NAT. Everything happens in your browser — nothing is sent anywhere.

Try it

How it works

The tool assembles the equivalent of: iptables -A [-i ] [-o ] -p [-s ] [-d ] [--dport ] [-m conntrack --ctstate ] [-m comment --comment ""] -j

only including each flag if you actually filled in that field, in the correct order iptables expects. It never executes anything — it just builds the text of the command for you to copy and run yourself (as root) on the target machine.

Notes

• Rules generated here are not applied automatically — iptables rule sets are also not persistent across reboots by default. On Debian/Ubuntu, install iptables-persistent (sudo apt install iptables-persistent) and run sudo netfilter-persistent save, or use iptables-save > /etc/iptables/rules.v4 in a startup script.
• --dport is only valid with -p tcp or -p udp — the tool will warn you if you set a port without a compatible protocol.
• For REJECT, the generated rule uses the default rejection method (icmp-port-unreachable for INPUT/FORWARD); add --reject-with <type> yourself if you need a specific ICMP type.
• Order matters in real firewalls: rules are evaluated top to bottom, and the first match wins. Use Insert (-I) to place a rule before existing ones (e.g., an ACCEPT rule before a catch-all DROP).
• Always keep a way to access the machine (e.g. console access) before testing DROP/REJECT rules on INPUT for SSH — it's easy to lock