Editing Iptables (section)

===Front-ends===
There are numerous third-party software applications for iptables that try to facilitate setting up rules. Front-ends in [[ncurses|textual]] or graphical fashion allow users to click-generate simple rulesets; scripts usually refer to [[Unix shell|shell scripts]] (but other scripting languages are possible too) that call iptables or (the faster) <code>iptables-restore</code> with a set of predefined rules, or rules expanded from a template with the help of a simple configuration file. Linux distributions commonly employ the latter scheme of using templates. Such a template-based approach is practically a limited form of a rule generator, and such generators also exist in standalone fashion, for example, as PHP web pages.

Such front-ends, generators and scripts are often limited by their built-in template systems and where the templates offer substitution spots for user-defined rules. Also, the generated rules are generally not optimized for the particular firewalling effect the user wishes, as doing so will likely increase the maintenance cost for the developer. Users who reasonably understand iptables and want their ruleset optimized are advised to construct their own ruleset.