Tink vs iptables
iptables is the classic Linux packet filter. It writes netfilter rules. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
iptables -L -n -v. Tink answers “why is this VPS sick?”
Accidental sysadmins land on iptables because the first SSH login still ends in iptables -A INPUT -p tcp --dport 80 -j ACCEPT. Then disk is at 91%, nginx dies, and last night's INPUT chain does not say what to run. A filling /var is a Tink warning; it is not a DROP rule.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using iptables if you already want a host packet filter. Use Tink if you run Linux servers and want a mechanic. They can sit on the same box.
| Feature | Tink | iptables |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Install iptables/iptables-persistent, write INPUT/FORWARD/OUTPUT chains, save rules, hope nft compat still loads them after reboot — then you still SSH in when the box is sick |
| What you get | Working monitoring, diagnosis, and approved fixes | Netfilter packet filter — tables, chains, matches, targets. Not a fleet mechanic |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who reads iptables -L -n -v after the outage |
| Hidden costs | None — fully managed | Rule order bugs, iptables vs nft, Docker NAT, and whether anyone watched disk while INPUT was ACCEPT |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Packet filter only. iptables does not watch fill time or propose a restart |
| Configuration | None after install — heuristics and AI | iptables-save, /etc/iptables/rules.v4, and whether the restore unit actually ran |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read iptables -L -n -v and conntrack yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Opens and closes ports only — iptables cannot restart nginx, free disk, or rotate a cert |
| Alerting | Built-in across 8 channels | None. A silent DROP in INPUT is not a Telegram page |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live packet filter only — iptables does not forecast fill time or a quiet NIC going bad later |
| Firewall / port exposure | Built-in — warns when the host firewall is inactive or dangerous DB ports listen | Yes for filter/nat — that is the job. It still will not say Redis is bound to 0.0.0.0 |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down, iptables is down too — no presence ping to Telegram |
| Public status page | Shareable URL with 90-day history | Not included — iptables has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a chain dump is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + iptables -L. No mechanic you text when /var filled |
| Learning curve | None — works after install | Low to -A INPUT -p tcp --dport 22 -j ACCEPT; higher to keep nat, mangle, and nft compat honest |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators who already want a host packet filter and will still SSH in when the box is sick |
When iptables is the right choice
Keep using iptables when you already want that exact job:
- Host packet filter — you need INPUT/FORWARD/NAT on this box, not a fleet digest.
- Netfilter CLI — iptables talks to the kernel; it is not a mechanic.
- No extra service — a userspace tool on the box, not a hub, SaaS, or Telegram bot.
- No conversation layer wanted — some operators prefer iptables-save and will never use a mechanic.
The real cost of “just write iptables rules”
The package is cheap to install. A working ops loop for five Linux boxes is not:
- A complete INPUT chain still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and a quiet agent never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — iptables stays a chain dump until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another ACCEPT line
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens iptables -L -n -v after the outage, and every scan includes a diagnosis a quiet packet filter will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs fail2ban · Tink vs CrowdSec · Tink vs sshguard