Loading page
About this tool
Generate valid ufw allow, deny, reject and limit rules for ports, ranges, source networks and app profiles, plus a safe enable order.
This generator writes syntactically valid ufw rules — the simple `ufw allow 22/tcp` form and the extended `ufw allow from 10.0.0.0/8 to any port 5432 proto tcp` form — and validates the parts ufw is strict about, such as requiring an explicit protocol for port lists and ranges. It also produces the ordering that keeps you connected: default policies, then an SSH rule, then your rules, then enable. Aimed at anyone administering a single Ubuntu or Debian server without a configuration management tool.
Open UFW Rule Generator on AltFTool — it loads instantly in your browser.
Provide your input — an image, text, or data.
Let the tool analyze or generate the result.
Review, refine, and reuse the output wherever you need it.
Catches the mistakes ufw rejects, like a port range without a protocol or a /33 prefix.
Puts the SSH rule before `ufw enable`, which is the step that most often locks people out of a VPS.
Points out that Docker publishes ports past ufw and that IPv6 rules need IPV6=yes in /etc/default/ufw.
deny drops the packet with no reply, so the client hangs until it times out. reject sends an ICMP unreachable, so the connection fails at once. Use deny facing the internet to avoid confirming the host exists, and reject inside a trusted network where fast failure is friendlier.
It allows the connection but blocks any source address that opens 6 or more connections within 30 seconds, which throttles SSH password-guessing. It relies on TCP connection tracking, so it cannot be applied to UDP services.
ufw requires an explicit protocol whenever the rule covers a range or a comma-separated list, because the underlying iptables multiport match needs one. Write ufw allow 6000:6010/tcp rather than ufw allow 6000:6010.
Docker inserts its own rules into the nat table, which is evaluated before ufw's filter chain, so published ports bypass ufw entirely. Publish to 127.0.0.1 with -p 127.0.0.1:8080:80, or add rules to the DOCKER-USER chain instead.