Table of Contents
- What is Iptables? (Understanding Tables, Chains, and Targets)
- How to Install Iptables (Ubuntu/Debian, CentOS/RHEL)
- Command Syntax & Essential Parameters (The “Perimeter” Cheat Sheet)
- Practical Examples (Allow SSH, HTTP, Block IPs, NAT)
- Persistence (Saving rules to survive reboot)
- Advanced Tips (Rate Limiting, Logging)
- Conclusion
1. What is Iptables?
Iptables is a user-space utility program that allows you to configure the IP packet filter rules of the Linux kernel firewall. Since 2001, it has been the standard firewall solution for most Linux distributions.
Think of Iptables as a gatekeeper for your server. It inspects every packet coming in, going out, or passing through your system and decides what to do based on a set of rules you define .
The Core Concepts: Tables, Chains, and Targets
To master Iptables, you must understand its three-tiered structure:
- Tables: Different tables handle different types of packet processing. The most common is the
filtertable (default), but there is alsonat(for Network Address Translation) andmangle(for packet alteration) . - Chains: Each table has built-in chains. For the
filtertable, these are:- INPUT: Packets coming into your server.
- OUTPUT: Packets leaving your server.
- FORWARD: Packets coming in but being routed through your server (acting as a router).
- Targets: What happens when a packet matches a rule.
- ACCEPT: Let the packet pass.
- DROP: Kill the packet (silently, no reply).
- REJECT: Kill the packet but send an error reply.
- LOG: Log the packet to syslog .
2. How to Install Iptables
Most Linux distributions come with Iptables pre-installed. However, if you need to ensure it is present or install the utilities, follow these steps:
Ubuntu / Debian
sudo apt-get update
sudo apt-get install iptablesRHEL / CentOS / Fedora
sudo dnf install iptables-servicesNote: Many modern distributions (like RHEL 8+) have moved to
nftablesas the default backend, but theiptablescommand is usually still available as a compatibility layer .
3. The Command Syntax & Its “Perimeters” (Parameters)
Here is the complete list of perimeters (parameters/options) you will use daily. This is your quick reference sheet.
Command Options (What to do)
| Option | Long Form | Description | Example |
|---|---|---|---|
| -A | --append | Add a rule to the end of a chain. | iptables -A INPUT ... |
| -I | --insert | Insert a rule at a specific position (default is top). | iptables -I INPUT 2 ... |
| -D | --delete | Delete a rule (specify the rule or line number). | iptables -D INPUT 3 |
| -L | --list | List all rules in a chain. | iptables -L -v -n |
| -F | --flush | Delete all rules (clear the chain). | iptables -F |
| -P | --policy | Set the default policy for a chain. | iptables -P INPUT DROP |
| -S | --list-rules | Print rules in a format readable by iptables-save. | iptables -S |
Rule Parameters (How to match)
| Parameter | Description | Syntax Example |
|---|---|---|
-p, --protocol | Match specific protocol (tcp, udp, icmp, all). | -p tcp |
-s, --source | Match source IP address or CIDR range. | -s 192.168.1.100 or -s 10.0.0.0/24 |
-d, --destination | Match destination IP address. | -d 203.0.113.1 |
-i, --in-interface | Name of the interface receiving the packet (eth0, lo). | -i lo (Localhost) |
-o, --out-interface | Name of the interface sending the packet. | -o eth0 |
--sport | Source port number. | --sport 1024:65535 (range) |
--dport | Destination port number. | --dport 22 (SSH) |
-m | Extend matching (e.g., state, multiport, iprange). | -m state --state ESTABLISHED |
-j | Target action (ACCEPT, DROP, REJECT, LOG). | -j DROP |
4. Practical Examples (Copy-Paste Ready)
Here are the most common scenarios for securing a Linux VPS or server.
Scenario 1: Basic Web Server Protection
Goal: Allow SSH (22), Web (80, 443), and nothing else.
# 1. Flush existing rules
sudo iptables -F
# 2. Set default policies (Drop all incoming, Allow outgoing)
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT
# 3. Allow Loopback (Local communication)
sudo iptables -A INPUT -i lo -j ACCEPT
# 4. Allow established connections (Keep SSH session alive)
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# 5. Open specific ports
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT # SSH
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # HTTP
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT # HTTPS
# 6. (Optional) Allow Ping
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPTScenario 2: Blocking an IP Address
Goal: Stop a malicious bot at 1.2.3.4.
# Insert at the top of the INPUT chain (-I) to ensure it matches first.
sudo iptables -I INPUT -s 1.2.3.4 -j DROP
# Block a whole subnet
sudo iptables -I INPUT -s 192.168.1.0/24 -j DROPScenario 3: NAT (Internet Gateway) & Port Forwarding
Goal: Share internet with an internal network (192.168.1.0/24) via eth0.
# 1. Enable IP Forwarding in the kernel
echo 1 > /proc/sys/net/ipv4/ip_forward
# 2. Setup Source NAT (Masquerade)
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# 3. Forward traffic
sudo iptables -A FORWARD -s 192.168.1.0/24 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -d 192.168.1.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Bonus: DNAT (Port Forwarding) - Route external 8080 to internal 80
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.100:80Scenario 4: Managing SSH Safely
Never lock yourself out of your remote server!
# Always add the ACCEPT rule FIRST when working remotely.
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# THEN change the default policy to DROP.
sudo iptables -P INPUT DROP
# To delete a rule (e.g., rule #3 in INPUT)
sudo iptables -L --line-numbers # Find the number
sudo iptables -D INPUT 3 # Delete by number5. Making Rules Persistent (Survive Reboot)
By default, Iptables rules are volatile. They vanish when the server restarts. You must save them to a file.
Method 1: Using iptables-persistent (Debian/Ubuntu)
# Install the persistence tool
sudo apt-get install iptables-persistent
# Save rules
sudo netfilter-persistent save
# or
sudo iptables-save > /etc/iptables/rules.v4Method 2: Manual Save (RHEL/CentOS)
# Save current rules to config file
sudo service iptables save
# or
sudo iptables-save > /etc/sysconfig/iptablesMethod 3: Restoring manually
# Load rules from a file
sudo iptables-restore < /etc/iptables/rules.v46. Advanced Tips for Sysadmins
Rate Limiting (DDoS Mitigation)
Limit SSH connection attempts to 3 per minute to prevent brute force:
sudo iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROPLogging Dropped Packets
To debug why something isn’t working, log before dropping:
sudo iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
sudo iptables -A INPUT -j DROPCheck logs using tail -f /var/log/messages or dmesg .
Dealing with IPv6
Iptables only handles IPv4. For IPv6, you must use ip6tables.
# Copy IPv4 rules to IPv6 structure (adjust protocols like ICMPv6)
sudo ip6tables -A INPUT -p tcp --dport 22 -j ACCEPTConclusion
Iptables remains a cornerstone of Linux security. Even with the rise of nftables and firewalld, understanding raw Iptables syntax gives you absolute control over your network traffic.
The Golden Rule: When working on a remote cloud server (AWS, DO, Vultr), never issue iptables -P INPUT DROP without first allowing SSH (--dport 22). You can save the commands above into a bash script (firewall.sh) and execute them to harden any Linux machine in under 30 seconds.
