UFW Firewall Rules Generator
Generate Ubuntu ufw allow, deny, reject, and limit commands with port ranges and CIDR sources. Copy a bash script in your browser. Free and private.
Loading tool...
What is UFW Firewall Rules Generator?
The UFW Firewall Rules Generator is a free browser tool that builds Ubuntu Uncomplicated Firewall commands for default policies, common services, and custom port or CIDR rules.
Key Benefits
- Start from deny-incoming defaults instead of an empty firewall
- Include SSH rate limiting and common web ports in one script
- Catch invalid ports and CIDRs before you paste onto a server
- Keep the plan local; nothing is uploaded
Common Use Cases
- •Hardening a new Ubuntu VPS before exposing SSH and HTTPS
- •Opening an app port range for a development server
- •Allowing a trusted office CIDR to reach a management port
- •Documenting a repeatable ufw baseline for a small fleet
How to Use the UFW Firewall Rules Generator
- Set default policies: Choose incoming and outgoing defaults (typically deny incoming and allow outgoing) plus a logging level.
- Pick common services: Enable SSH, HTTP, HTTPS, or other presets. SSH uses ufw limit to slow brute-force attempts.
- Add custom rules: Optionally add allow, deny, reject, or limit rules with a port, port range, and source CIDR.
- Copy the script: Review the generated bash commands, then copy or download and run them on Ubuntu as root after checking each line.
Key Features
- Default incoming and outgoing policies with logging levels
- Common services including SSH rate-limit, HTTP, HTTPS, DNS, and WireGuard
- Custom allow, deny, reject, and limit rules
- Port ranges and source CIDR (from) syntax
- Copy or download a bash script with optional reset and enable
Frequently Asked Questions
What is ufw on Ubuntu?
ufw (Uncomplicated Firewall) is Ubuntu’s frontend for iptables/nftables. Commands like ufw allow 80/tcp open a port. This tool only writes those commands; it does not change your local machine firewall.
Why does SSH use limit instead of allow?
ufw limit 22/tcp still accepts SSH but rate-limits new connections from the same source, which slows password-guessing. Switch the custom rule to allow if you rely on keys and want no limit.
How do port ranges and source CIDRs look?
A range uses a colon, such as 3000:3001/tcp. A source uses from, for example ufw allow from 192.168.1.0/24 to any port 22 proto tcp. Invalid values are skipped with a warning.
Are my rules uploaded?
No. Script generation runs entirely in your browser. Copy the output and apply it on a server you control after you review it.