Managing Firewall with iptables
1. Viewing iptables Rules
| Command | Description | Example |
|---|---|---|
| iptables -L | List all rules in all chains | iptables -L |
| iptables -L -n | List rules with numeric IP addresses and port numbers | iptables -L -n |
| iptables -L INPUT | List rules in the INPUT chain only | iptables -L INPUT |
| iptables -S | Display rules in a format suitable for saving and restoring | iptables -S |
| iptables -L --line-numbers | List rules with line numbers for easier editing | iptables -L --line-numbers |
Note: The
-L option lists rules in the current iptables configuration. Rules are processed in order, and the first matching rule is applied.2. Understanding Chains
| Chain | Description | Default Target | Usage |
|---|---|---|---|
| INPUT | Handles incoming packets destined for the local system | ACCEPT, DROP, or REJECT |
Control access to services running on the host |
| OUTPUT | Handles packets generated locally by the system | ACCEPT, DROP, or REJECT |
Manage outbound traffic from the host |
| FORWARD | Processes packets that are being routed through the system | ACCEPT, DROP, or REJECT |
Control traffic passing through the host (e.g., router or NAT) |
| PREROUTING | Handles packets before routing decisions are made | ACCEPT, DROP, or REJECT |
Used for DNAT and packet modification before routing |
| POSTROUTING | Handles packets after routing decisions are made | ACCEPT, DROP, or REJECT |
Used for SNAT and packet modification after routing |
Note: The
INPUT, OUTPUT, and FORWARD chains are the most commonly configured.
3. Adding Rules
| Rule Type | Command Syntax | Description | Example |
|---|---|---|---|
| INPUT | -A INPUT -s 192.168.1.0/24 -j ACCEPT |
Allow traffic from a specific subnet to reach the server | Example: Allow local network access sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT |
| OUTPUT | -A OUTPUT -d 8.8.8.8 -p udp --dport 53 -j ACCEPT |
Allow outbound DNS queries to Google's public DNS | Example: Allow DNS lookups sudo iptables -A OUTPUT -d 8.8.8.8 -p udp --dport 53 -j ACCEPT |
| FORWARD | -A FORWARD -i eth0 -o eth1 -j ACCEPT |
Allow forwarding packets between interfaces | Example: Enable NAT forwarding sudo iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT |
Note: Rules are processed in order, so more specific rules should come before general ones.
4. Deleting Rules
| Rule ID | Command | Description |
|---|---|---|
| -L | iptables -L |
List all rules in the current chain |
| -D | iptables -D [chain] [rule] |
Delete a specific rule from the chain |
| -F | iptables -F [chain] |
Flush all rules in a specific chain |
| -X | iptables -X [chain] |
Delete a user-defined chain |
Example: Delete a specific rule by number
# List rules to find the rule number
iptables -L --line-numbers
# Delete rule at line 3 in INPUT chain
iptables -D INPUT 3Example: Delete rule by matching criteria
# Delete rule that allows TCP traffic on port 80
iptables -D INPUT -p tcp --dport 80 -j ACCEPT
Note: When deleting rules, ensure that the rule matches exactly or use line numbers to avoid unintended deletions.
5. Setting Default Policies
| Policy | Description | Usage |
|---|---|---|
| ACCEPT | Allows packets to pass through the firewall | iptables -P INPUT ACCEPT |
| DROP | silently discards packets without sending a response | iptables -P INPUT DROP |
| REJECT | Blocks packets and sends an error response (e.g., port unreachable) | iptables -P INPUT REJECT |
Note: Setting a default policy to
DROP or REJECT can block access to your system if not configured properly. Always ensure you have a way to regain access (e.g., SSH tunnel or console access).6. Filtering by Source and Destination
| Rule Component | Description | Example |
|---|---|---|
| -s | Matches packets originating from the specified source IP address or network | -s 192.168.1.100 |
| -d | Matches packets destined for the specified destination IP address or network | -d 10.0.0.1 |
| -s & -d | Combined source and destination matching | -s 192.168.1.0/24 -d 10.0.0.0/24 |
Example: Allow traffic from specific subnet to a server
# Allow traffic from 192.168.1.0/24 to web server at 10.0.0.10
iptables -A INPUT -s 192.168.1.0/24 -d 10.0.0.10 -p tcp --dport 80 -j ACCEPTExample: Block traffic from specific IP to a service
# Block all traffic from 192.168.1.50 to SSH service
iptables -A INPUT -s 192.168.1.50 -d 10.0.0.10 -p tcp --dport 22 -j DROP
Note: When using
-s and -d, ensure that the order of rules matters. More specific rules should come before general ones to avoid unintended blocking or allowing.
7. Filtering by Port
| Rule Type | Port(s) | Action | Description |
|---|---|---|---|
| INPUT | 22 |
ACCEPT | Allow SSH connections |
| INPUT | 80 |
ACCEPT | Allow HTTP traffic |
| INPUT | 443 |
ACCEPT | Allow HTTPS traffic |
| INPUT | 2222 |
DROP | Block access to alternative SSH port |
8. Filtering by Protocol
| Protocol | Description | Example Rule | Notes |
|---|---|---|---|
| tcp | Transmission Control Protocol for reliable, connection-oriented communication | -p tcp --dport 80 -j ACCEPT |
Commonly used for web traffic |
| udp | User Datagram Protocol for connectionless, unreliable communication | -p udp --dport 53 -j ACCEPT |
Used for DNS queries and VoIP |
| icmp | Internet Control Message Protocol for network diagnostics and error reporting | -p icmp --icmp-type echo-request -j ACCEPT |
Allows ping requests to pass through |
| all | Matches all protocols (use with caution) | -p all -j DROP |
Can block all traffic if misconfigured |
9. Using Connection Tracking
| Feature | Description | Notes |
|---|---|---|
| conntrack | Kernel module for connection tracking | Required for stateful filtering |
| conntrack-tools | Userspace tools for conntrack | Provides conntrack command-line utility |
Note: Connection tracking is essential for stateful packet filtering in iptables.
Warning: Flushing connections can disrupt ongoing network sessions.
10. NAT and Port Forwarding
| Rule Type | Command | Description |
|---|---|---|
| NAT Rule | -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 |
Redirects incoming traffic on port 80 to port 8080 |
| Port Forwarding | -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.1.10:443 |
Forwards traffic on port 443 to internal IP and port |
| Masquerade | -t nat -A POSTROUTING -o eth0 -j MASQUERADE |
Changes source IP to the gateway's IP for outbound traffic |
Example: Set up Port Forwarding
# Forward external port 80 to internal server on port 8080
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
# Allow forwarded traffic in the filter table
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 8080 -j ACCEPT
Note: Ensure that
netfilter modules are loaded and iptables is installed.
Warning: Misconfiguring NAT rules can lead to network outages or security vulnerabilities.
11. Saving iptables Rules
| Command | Description | Notes |
|---|---|---|
| iptables-save | Saves current iptables rules to stdout | Useful for viewing or piping rules |
| iptables-save > /etc/iptables/rules.v4 | Saves IPv4 rules to a file | Common location for persistent rules on Debian/Ubuntu systems |
| ip6tables-save > /etc/iptables/rules.v6 | Saves IPv6 rules to a file | Used for saving IPv6 firewall rules |
Example: Save iptables rules to file
# Save IPv4 rules
iptables-save > /etc/iptables/rules.v4
# Save IPv6 rules
ip6tables-save > /etc/iptables/rules.v6Note: On systems using
iptables-persistent, rules are typically saved to /etc/iptables/rules.v4 and /etc/iptables/rules.v6 to persist across reboots.Warning: Ensure the directory
/etc/iptables exists before saving rules, or the command will fail.12. Logging Traffic
| Option | Values | Description |
|---|---|---|
| --log-prefix | string |
Prefix for log messages |
| --log-level | 0-7 |
Log level (0=emerg, 7=debug) |
| --log-tcp-options | boolean |
Log TCP options |
| --log-ip-options | boolean |
Log IP options |
Note: Logs are written to
/var/log/kern.log or /var/log/messages depending on system configuration.
Warning: Excessive logging can impact system performance and fill disk space quickly.