Firewall Rule Prompt Generator
Generates a fill-in prompt for asking an AI to write firewall rules
About this generator
Firewall rules written under pressure are how SSH gets opened to `0.0.0.0/0` and stays that way. This tool generates a fill-in prompt that instructs an AI assistant to write rules with a default-deny inbound policy, management ports restricted to specific source IPs, and an explicit warning about anything that could lock you out. Pick the tool — `ufw`, `iptables`, `firewalld`, or AWS security group — and describe what to allow or deny. The prompt asks for a default-deny inbound policy with an explanation, the exact rules in order, management ports restricted to specific source ranges, a comment on every rule, instructions to verify and persist the config, and a lockout warning. Paste the prompt into your assistant, test on a non-critical host first, and keep a console session open while applying rules to any machine you access remotely.
How to use
- Pick your firewall tool.
- Describe what to allow or deny.
- Click Generate to build the prompt.
- Paste it into your AI assistant and test on a non-critical host first.
Use Cases
- •Getting safe firewall rules from an AI assistant
- •Locking SSH to specific source IPs instead of the world
- •Setting a default-deny inbound policy correctly
- •Writing rules for ufw, iptables, firewalld, or AWS
- •Standardising how a team requests firewall changes
Tips
- →Allow your own IP before tightening SSH to avoid lockout.
- →Default to deny inbound and open only what you need.
- →Keep a console or out-of-band session open while applying rules.
- →Persist rules so they survive a reboot once verified.
FAQ
why default to deny inbound
A default-deny inbound policy means only traffic you explicitly allow gets through. Default-allow leaves every unlisted port open, so a service started on an unexpected port becomes an attack surface you may never notice.
why restrict SSH to specific source IPs
Exposing SSH to `0.0.0.0/0` invites constant brute-force and credential-stuffing attempts. Limiting the management port to your office or VPN IP range eliminates that entire class of attack, which is why the prompt makes it a hard requirement.
how do I avoid locking myself out when applying rules
The prompt asks the assistant to flag rules that could cut your access and to keep changes reversible. In practice: allow your own IP first, keep a console or out-of-band session open, and use a timed rollback so a mistake undoes itself.
You might also like
Popular tools from other categories that share themes with this one.