OneTaskBy Tim King · Updated
Firewall Rule Explainer
Explain iptables and ufw Rules in Plain English, Flagging Open Ports and Accept-All
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Firewall Rule Explainer works
This firewall rule explainer reads iptables and ufw rules and says what each one does in plain English. Paste commands, the output of iptables-save or ufw status, and it lists every rule with warnings for anything that leaves your server more exposed than you might think.
What the firewall rule explainer checks
Each line is parsed for the chain, action, protocol, source, destination, ports, interface and connection state, then written out as a sentence such as "Allow incoming TCP to port 22 from 203.0.113.0/24". Default policies from iptables -P, the :INPUT DROP lines in a save file and ufw default commands are read too.
The warnings catch the mistakes that matter. An incoming default of ACCEPT means anything not explicitly blocked is allowed. Databases, remote desktop and other risky ports open to any address are flagged, as are rules that accept everything and sources of 0.0.0.0/0. Rules placed after an unconditional accept or drop are marked as never reached, because iptables stops at the first match.
The explainer reads rules as text only. It does not see NAT tables, Docker's own chains or cloud firewalls in front of the server, so check those separately.
FAQ
Why does rule order matter?
iptables checks rules from the top and stops at the first one that matches. A broad accept near the top makes every later drop for the same traffic pointless. Insert specific rules above general ones with -I instead of appending them with -A.
What does ufw limit do?
It allows the connection but blocks any address that opens six or more connections in 30 seconds. It is a cheap brake on password guessing against SSH, though key-only logins are still the real protection.
Should the default incoming policy be DROP?
Yes, for a server. Drop everything incoming by default, then allow loopback, established connections and the specific ports you serve. Allow SSH before changing the policy so you do not lock yourself out.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
IP Allowlist Builder
Turn a list of IPs into allow or block rules for your server.
Port Number Lookup
See what runs on a port and whether exposing it is risky.
IP Range To CIDR Converter
Turn start and end IP addresses into the fewest CIDR blocks.
CHMOD Calculator
Convert Unix permissions between rwx, octal and symbolic.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.