iptables Rule Generator
Render a bounded shared firewall rule as safely quoted, review-only iptables or ip6tables commands.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
iptables commands
REJECT with conntrack state INVALID is discouraged by iptables documentation. Delayed packets may be classified INVALID, and rejecting them can break an otherwise healthy connection. DROP is normally recommended for INVALID packets.
How it works
Imports only the Firewall Rule Builder JSON model and renders display-only iptables or ip6tables argument vectors. Multiple source/destination CIDRs and port ranges expand to their exact Cartesian-product rules, capped at 64 match rules; logging produces a separate LOG command before each final action. inet rules are rejected because iptables and ip6tables are separate commands. The iptables documentation discourages REJECT for conntrack state INVALID: a delayed packet may be classified INVALID, and rejecting it can break an otherwise healthy connection, so DROP is normally recommended for INVALID packets. Such a rule is still rendered as written, with a warning. Nothing is executed or applied.