All free tools Generated in your browser

UFW Firewall Generator

Describe the firewall you want and receive an ordered list of ufw commands to review and run on your server.

FIREWALL SETTINGS

Build a ufw command script

ufw
Default policies
Applied to traffic that no rule matches.
Denying outgoing traffic breaks updates and DNS unless you add rules for them.
Traffic forwarded through the server, for example for containers or a VPN.
Firewall behaviour
Higher levels log matched packets as well as blocked ones and can fill the disk on a busy server.
SSH access
Use the port your sshd actually listens on, between 1 and 65535.
Firewall rules

A wrong firewall rule applied over SSH can lock you out. Always allow your SSH port before enabling the firewall, keep a second SSH session open while you apply the commands, and make sure you have console or VNC access from your provider panel before you start.

We do not store your data. Every port, address and comment you type is validated and turned into commands locally in your browser. Nothing is submitted to VPSLake.

HOW TO USE IT

Generate in four steps

Plan the rules before you touch the server, then apply them from a session you can afford to lose.

  1. 1

    Set the default policies

    Most servers use deny incoming, allow outgoing and deny routed. Confirm your SSH port so the allow rule is generated before the firewall is enabled.

  2. 2

    Add the traffic you want to accept

    Add one rule per service. Give a port such as 443, a range such as 8000:8100, or pick an application profile such as Nginx Full. Restrict a rule to one source address when only your office or monitoring host needs it.

  3. 3

    Generate and read the script

    Select the generate button. The output is an ordered command script: optional reset, IPv6 setting, default policies, the SSH rule, your rules, logging, ufw --force enable and finally ufw status verbose.

  4. 4

    Apply it with a second session open

    Copy the script to the server, or download ufw-rules.sh and upload it, then run sudo sh ufw-rules.sh. Keep your current SSH session connected and open a new one to confirm you can still log in before you close anything.

How a UFW rule is put together

UFW has a short form and a long form. The short form, ufw allow 443/tcp, is used when a rule only needs an action and a port. The long form, ufw allow in on eth0 proto tcp from 203.0.113.0/24 to any port 443, is used as soon as the rule names a source address or an interface.

The generator picks the correct form for each rule automatically. It also enforces the rules UFW itself enforces: a port range such as 8000:8100 or a list such as 80,443 must name tcp or udp, because UFW cannot apply a multi-port match to every protocol at once.

Application profiles come from files in /etc/ufw/applications.d that packages install. Choosing a profile means the ports follow the package rather than a number you typed, which is why the port and protocol fields are disabled when a profile is selected. Run sudo ufw app list on the server to see which profiles exist there.

What the generated script contains

The output is a plain shell script with numbered comments, not a configuration file. Nothing in it is written into /etc/ufw by hand, so you can read every change before it happens and re-run the script safely after a reset.

  • Optional ufw --force reset at the top
  • The IPV6 setting in /etc/default/ufw
  • Default incoming, outgoing and routed policies
  • The SSH allow or limit rule, before enabling
  • Your service rules with optional comments
  • The logging level, ufw --force enable and a status check

Comments are written as comment 'text' and are limited to letters, numbers, spaces and a small set of punctuation, so nothing you type can turn into a second shell command.

Test the firewall before you trust it

This script is a reviewed starting point, not an audited or guaranteed-safe configuration. Read every line against the services your server actually runs, apply it while a second SSH session is open, and confirm you can open a fresh connection afterwards. If you lose access, use the console or VNC session in your hosting panel and run sudo ufw disable to get back in. Enabling deny outgoing or resetting a firewall on a production server can also break package updates, DNS, monitoring agents and backups, so check those before you apply the change.

FREQUENTLY ASKED QUESTIONS

UFW Firewall Generator FAQ

The commands use standard UFW syntax and work on Ubuntu 18.04 and later and on Debian 10 and later, where UFW is packaged as ufw. Install it first with sudo apt install ufw if the command is missing. On systems that use firewalld or nftables directly, use a firewalld or nftables configuration instead of UFW.
UFW rejects a multi-port rule that does not name a protocol, because the underlying multiport match has to be attached to tcp or udp. The generator reports this before you run anything rather than letting the command fail on the server. Set the protocol on that rule, or add two rules if you need both.
UFW reads IPV6=yes or IPV6=no from /etc/default/ufw when it builds its rule set. With it set to no, every rule you add applies to IPv4 only and IPv6 traffic is not filtered by UFW at all. The script edits that setting with sed before the rules are added, because the value has to be correct before the firewall is enabled.
Run sudo ufw status numbered to list the rules with an index, then sudo ufw delete 4 to remove the fourth one. Deleting a rule renumbers the rest, so work from the highest number downwards. To remove everything and start again, run sudo ufw --force reset, which is what the reset checkbox adds to the top of the script.
deny drops the packet without an answer, so the client waits until it times out. reject sends an ICMP error back, so the client fails immediately. Dropping is the usual choice for traffic from the public internet; rejecting is friendlier on an internal network where a fast failure is more useful than hiding the port.
ufw limit denies a source address that has started six or more connections to that port in the last 30 seconds. It slows down password-guessing against SSH without any extra software. It is a blunt limit, so a busy automation host that opens many short-lived SSH sessions from one address may trip it; give that host its own allow rule with a source address if that happens.
Comments are written into the script inside single quotes. Allowing a quote, a semicolon, a backtick or a dollar sign would let a pasted string end the quoted text and become a separate shell command. The field therefore accepts letters, numbers, spaces and the characters . _ - / : + # ( ) only.
No. The page contains no upload, no analytics capture of the form and no network request of any kind for your input. Validation and script generation run entirely in your browser, and the download is produced from text your browser already holds.
It does not generate NAT or port-forwarding entries for /etc/ufw/before.rules, does not manage application profile files, and does not read the firewall you already have. It writes the ordinary ufw commands only, so nothing it produces depends on a file layout the generator cannot see.