Pick what the server runs and who may reach it. You get matching rules for nftables, iptables and UFW, with a default-deny policy that keeps your SSH session open.
Services to Open
Check Before You Apply
SSH is open to the whole internet. Limit it to your own addresses if they are fixed.
These rules replace the existing input rules. Check nothing else (Docker, fail2ban, the Proxmox firewall) manages this server's firewall first.
/etc/nftables.conf
#!/usr/sbin/nft -f
# /etc/nftables.conf: generated at frabs.net/tools/firewall-rule-generator/
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
ct state invalid drop
iif "lo" accept
ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } limit rate 10/second accept
ip6 nexthdr icmpv6 accept # IPv6 needs ICMPv6 for neighbour discovery
tcp dport 22 accept # SSH
}
chain forward {
type filter hook forward priority 0; policy accept;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
# Apply: nft -f /etc/nftables.conf
# Keep at boot: systemctl enable nftablesHow to Use
Tick the ports to open, or add your own.
Restrict SSH and admin ports to your own addresses.
Pick nftables, iptables or UFW, and paste the commands on the server.
Security & Abuse
Always allow established connections and your SSH port before setting the default policy to drop, or you will lock yourself out. The generated rules do that in the right order. On a remote server, run them inside a screen or tmux session, or schedule a rollback (for example: at now + 5 minutes <<< 'nft flush ruleset') and cancel it once you have checked you can still connect.
nftables is the modern Linux firewall and the default on Debian 10+, Ubuntu 20.10+ and RHEL 8+. iptables commands still work through the iptables-nft layer. UFW is a simpler front end on Ubuntu. Use one of them, not several: rules from different tools on the same host are hard to reason about.
Docker and Proxmox's firewall manage their own rules; check how they interact before adding host rules on those systems.
Most firewalls only filter what comes in. On servers that host other people's VMs, outbound is where abuse comes from: spam on port 25, scans and floods. Blocking outbound 25 for VMs that do not need it removes most spam complaints. Frabs goes further and watches each VM's traffic for the behaviour itself.
Port Guides
Free Tools
Frabs stops the abuse going out: spam, scans and floods from any VM, caught by behaviour, not by port.