Dev
Firewall Rule Prompt Generator
Firewall rules written under pressure are how SSH gets opened to `0.0.0.0/0` and stays that way. This tool generates a fill-in prompt that instructs an AI assistant to write rules with a default-deny inbound policy, management ports restricted to specific source IPs, and an explicit warning about anything that could lock you out. Pick the tool — `ufw`, `iptables`, `firewalld`, or AWS security group — and describe what to allow or deny. The prompt asks for a default-deny inbound policy with an explanation, the exact rules in order, management ports restricted to specific source ranges, a comment on every rule, instructions to verify and persist the config, and a lockout warning. Paste the prompt into your assistant, test on a non-critical host first, and keep a console session open while applying rules to any machine you access remotely.
How to use
- Choose your options above
- Click Generate
- Copy your result
Detailed instructions
- Pick your firewall tool.
- Describe what to allow or deny.
- Click Generate to build the prompt.
- Paste it into your AI assistant and test on a non-critical host first.
Use Cases
- •Getting safe firewall rules from an AI assistant
- •Locking SSH to specific source IPs instead of the world
- •Setting a default-deny inbound policy correctly
- •Writing rules for ufw, iptables, firewalld, or AWS
- •Standardising how a team requests firewall changes
Tips
- →Allow your own IP before tightening SSH to avoid lockout.
- →Default to deny inbound and open only what you need.
- →Keep a console or out-of-band session open while applying rules.
- →Persist rules so they survive a reboot once verified.
FAQ
why default to deny inbound
A default-deny inbound policy means only traffic you explicitly allow gets through. Default-allow leaves every unlisted port open, so a service started on an unexpected port becomes an attack surface you may never notice.
why restrict SSH to specific source IPs
Exposing SSH to `0.0.0.0/0` invites constant brute-force and credential-stuffing attempts. Limiting the management port to your office or VPN IP range eliminates that entire class of attack, which is why the prompt makes it a hard requirement.
how do I avoid locking myself out when applying rules
The prompt asks the assistant to flag rules that could cut your access and to keep changes reversible. In practice: allow your own IP first, keep a console or out-of-band session open, and use a timed rollback so a mistake undoes itself.
You might also like
Popular tools from other categories that share themes with this one.
Try these next
More free tools from other corners of the catalog, picked by shared themes.