iptables Configuration: Complete Guide

Introduction

iptables is the traditional and powerful packet filtering framework that has been the cornerstone of Linux firewall management for decades. As a user-space utility for configuring the Linux kernel's netfilter framework, iptables provides comprehensive control over network traffic, enabling administrators to create sophisticated security policies, implement Network Address Translation (NAT), perform port forwarding, and build complex routing scenarios. Despite the emergence of newer alternatives like nftables and firewalld, iptables remains widely deployed and deeply understood across the Linux ecosystem, making it an essential skill for system administrators, security professionals, and network engineers.

Understanding iptables goes beyond simply blocking or allowing traffic—it encompasses packet filtering, connection tracking (stateful inspection), network address translation, packet mangling, and traffic shaping. Whether you're hardening a single server, building enterprise firewalls, implementing DMZ architectures, or configuring complex multi-tier applications, iptables provides the granular control needed to secure and optimize network communications.

This comprehensive guide covers iptables from fundamentals to advanced configurations, including rule syntax, table structures, chain processing, stateful firewalling, NAT configurations, logging, and troubleshooting. By mastering iptables, you'll gain deep insights into network security and packet processing that apply across diverse Linux environments and security scenarios.

Understanding iptables Architecture

Netfilter Framework

iptables is the user-space command-line interface to the kernel-level netfilter framework, which provides:

Packet filtering - Accept, drop, or reject packets based on rules
NAT - Network Address Translation (SNAT, DNAT, masquerading)
Packet mangling - Modify packet headers
Connection tracking - Stateful packet inspection

Tables

iptables organizes rules into tables based on function:

1. filter (Default table)

Purpose: Packet filtering decisions
Chains: INPUT, OUTPUT, FORWARD
Use: Standard firewall rules

2. nat

Purpose: Network Address Translation
Chains: PREROUTING, POSTROUTING, OUTPUT
Use: Port forwarding, masquerading, source NAT

3. mangle

Purpose: Packet alteration
Chains: PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING
Use: Modify TOS, TTL, set marks

4. raw

Purpose: Configure exemptions from connection tracking
Chains: PREROUTING, OUTPUT
Use: Performance optimization, NOTRACK

5. security (SELinux)

Purpose: Mandatory Access Control rules
Chains: INPUT, OUTPUT, FORWARD
Use: SELinux policy integration

Chains

Chains are lists of rules processed sequentially:

Built-in chains:

INPUT - Packets destined for local system
OUTPUT - Packets originating from local system
FORWARD - Packets routed through system
PREROUTING - Packets before routing decision
POSTROUTING - Packets after routing decision

User-defined chains:

Custom chains for organizing complex rulesets
Called from built-in chains with -j (jump) target

Packet Flow Through iptables

Incoming Packet
       ↓
   PREROUTING (nat, mangle, raw)
       ↓
   Routing Decision
    ↙     ↘
INPUT        FORWARD
(local)      (router)
   ↓            ↓
Local          POSTROUTING
Process          ↓
   ↓          Outgoing
OUTPUT
   ↓
POSTROUTING (nat, mangle)
   ↓
Outgoing Packet

Rule Structure

iptables -t <table> -<action> <chain> <match> -j <target>

Components:

-t table: Specify table (default: filter)
-action: -A (append), -I (insert), -D (delete), -R (replace)
chain: INPUT, OUTPUT, FORWARD, etc.
match: Criteria for matching packets
-j target: Action to take (ACCEPT, DROP, REJECT, LOG, etc.)

Prerequisites

Before configuring iptables, ensure you have:

Root or sudo access to Linux system
Basic understanding of TCP/IP networking
Knowledge of services and ports you want to protect
SSH access (preferably also console/KVM access)
Backup access method in case of lockout
iptables installed (usually pre-installed)

Check iptables Installation

# Verify iptables is installed
iptables --version

# Check current rules
sudo iptables -L -n -v

# View NAT rules
sudo iptables -t nat -L -n -v

Basic iptables Commands

Viewing Rules

# List all rules
sudo iptables -L

# List with line numbers
sudo iptables -L --line-numbers

# List with packet/byte counts
sudo iptables -L -v

# List without DNS resolution (faster)
sudo iptables -L -n

# List specific chain
sudo iptables -L INPUT

# List all tables and chains
sudo iptables -S

Adding Rules

# Append rule to end of chain
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Insert rule at specific position
sudo iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

# Insert at line number
sudo iptables -I INPUT 5 -p tcp --dport 80 -j ACCEPT

Deleting Rules

# Delete by specification
sudo iptables -D INPUT -p tcp --dport 22 -j ACCEPT

# Delete by line number
sudo iptables -D INPUT 3

# Flush all rules in chain
sudo iptables -F INPUT

# Flush all rules in all chains
sudo iptables -F

# Flush all rules in all tables
sudo iptables -F
sudo iptables -t nat -F
sudo iptables -t mangle -F

Setting Default Policies

# Set default policy for chain
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD DROP

# View policies
sudo iptables -L | grep policy

Basic Firewall Configuration

Simple Allow SSH Access

# Allow SSH (port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Set default policy
sudo iptables -P INPUT DROP

Web Server Configuration

# Allow HTTP
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Drop everything else
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

Complete Basic Firewall Script

#!/bin/bash
# basic-firewall.sh

# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Set default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP and HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log dropped packets
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables INPUT denied: " --log-level 7

echo "Firewall configured successfully"

Advanced Matching Criteria

Protocol Matching

# Match TCP
sudo iptables -A INPUT -p tcp -j ACCEPT

# Match UDP
sudo iptables -A INPUT -p udp -j ACCEPT

# Match ICMP
sudo iptables -A INPUT -p icmp -j ACCEPT

# Match by protocol number
sudo iptables -A INPUT -p 6 -j ACCEPT  # TCP is protocol 6

Port Matching

# Single destination port
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Single source port
sudo iptables -A INPUT -p tcp --sport 1024 -j ACCEPT

# Port range
sudo iptables -A INPUT -p tcp --dport 1000:2000 -j ACCEPT

# Multiple ports (requires multiport extension)
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT

IP Address Matching

# Match source IP
sudo iptables -A INPUT -s 192.168.1.100 -j ACCEPT

# Match destination IP
sudo iptables -A INPUT -d 10.0.0.50 -j ACCEPT

# Match subnet
sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

# Exclude IP (not)
sudo iptables -A INPUT -s ! 192.168.1.100 -j DROP

Interface Matching

# Match input interface
sudo iptables -A INPUT -i eth0 -j ACCEPT

# Match output interface
sudo iptables -A OUTPUT -o eth1 -j ACCEPT

# Multiple interfaces (use wildcards)
sudo iptables -A INPUT -i eth+ -j ACCEPT

State Matching (Connection Tracking)

# Allow established and related connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow new connections
sudo iptables -A INPUT -m state --state NEW -j ACCEPT

# Drop invalid packets
sudo iptables -A INPUT -m state --state INVALID -j DROP

# Combined states
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Connection states:

NEW - First packet of new connection
ESTABLISHED - Part of existing connection
RELATED - Related to existing connection (e.g., FTP data)
INVALID - Packet doesn't belong to known connection

Time-Based Rules

# Allow access during business hours
sudo iptables -A INPUT -p tcp --dport 80 -m time --timestart 09:00 --timestop 17:00 -j ACCEPT

# Allow on weekdays only
sudo iptables -A INPUT -p tcp --dport 22 -m time --weekdays Mon,Tue,Wed,Thu,Fri -j ACCEPT

# Block at night
sudo iptables -A INPUT -p tcp --dport 80 -m time --timestart 22:00 --timestop 06:00 -j DROP

Rate Limiting

# Limit connections per IP
sudo iptables -A INPUT -p tcp --dport 22 -m connlimit --connlimit-above 3 -j REJECT

# Limit new connections per time period
sudo iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# Prevent SYN flood
sudo iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --syn -j DROP

MAC Address Matching

# Allow specific MAC address
sudo iptables -A INPUT -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT

# Block specific MAC
sudo iptables -A INPUT -m mac --mac-source 00:11:22:33:44:55 -j DROP

Network Address Translation (NAT)

Source NAT (SNAT) / Masquerading

Masquerading (dynamic SNAT):

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf

# Masquerade outgoing traffic
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Allow forwarding from internal network
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

Static SNAT:

# Change source IP to specific address
sudo iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 203.0.113.50

# SNAT for specific source network
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 203.0.113.50

Destination NAT (DNAT) / Port Forwarding

Forward external port to internal server:

# Forward port 80 to internal web server
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80

# Forward port 443 to internal server
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443

# Allow forwarded traffic
sudo iptables -A FORWARD -p tcp -d 192.168.1.100 --dport 80 -j ACCEPT

Port redirection (local port forwarding):

# Redirect local port 80 to 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# Or for OUTPUT chain (locally generated traffic)
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 8080

Complete NAT Router Configuration

#!/bin/bash
# nat-router.sh

# Enable IP forwarding
sysctl -w net.ipv4.ip_forward=1

# Flush NAT table
iptables -t nat -F

# Masquerade outgoing traffic
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Port forwarding examples
# Forward SSH to internal server
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.10:22

# Forward web traffic to web server
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443

# Allow forwarding
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 192.168.1.0/24 -j ACCEPT

Logging

Basic Logging

# Log and drop
sudo iptables -A INPUT -j LOG --log-prefix "iptables DROP: "
sudo iptables -A INPUT -j DROP

# Log with custom prefix
sudo iptables -A INPUT -p tcp --dport 23 -j LOG --log-prefix "TELNET attempt: "

# Set log level
sudo iptables -A INPUT -j LOG --log-level 4 --log-prefix "iptables: "

Log levels:

0 - emerg
1 - alert
2 - crit
3 - err
4 - warning
5 - notice
6 - info
7 - debug

Rate-Limited Logging

# Prevent log flooding
sudo iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
sudo iptables -A INPUT -j DROP

Log Specific Events

# Log invalid packets
sudo iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "INVALID packet: "

# Log new SSH connections
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j LOG --log-prefix "New SSH: "

# Log port scans
sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "Port scan: "

View iptables Logs

# View iptables logs in syslog
sudo tail -f /var/log/syslog | grep iptables

# Or in messages
sudo tail -f /var/log/messages | grep iptables

# Using journalctl
sudo journalctl -f | grep iptables

User-Defined Chains

Creating Custom Chains

# Create new chain
sudo iptables -N LOGGING

# Add rules to custom chain
sudo iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "iptables packet dropped: " --log-level 7
sudo iptables -A LOGGING -j DROP

# Jump to custom chain
sudo iptables -A INPUT -j LOGGING

Organizing Complex Rulesets

# Create service-specific chains
sudo iptables -N SSH_CHECK
sudo iptables -N HTTP_CHECK

# SSH chain rules
sudo iptables -A SSH_CHECK -p tcp --dport 22 -m connlimit --connlimit-above 3 -j REJECT
sudo iptables -A SSH_CHECK -p tcp --dport 22 -j ACCEPT

# HTTP chain rules
sudo iptables -A HTTP_CHECK -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# Jump to chains from INPUT
sudo iptables -A INPUT -p tcp --dport 22 -j SSH_CHECK
sudo iptables -A INPUT -p tcp --dport 80 -j HTTP_CHECK

Security Hardening

Protect Against Common Attacks

SYN Flood Protection:

# Limit SYN packets
sudo iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --syn -j DROP

# Or using kernel parameters
sudo sysctl -w net.ipv4.tcp_syncookies=1

Port Scan Protection:

# Detect NULL packets
sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Detect XMAS packets
sudo iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Detect stealth scans
sudo iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

Ping of Death Protection:

# Limit ping requests
sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

Invalid Packet Dropping:

# Drop invalid packets
sudo iptables -A INPUT -m state --state INVALID -j DROP

IP Spoofing Protection:

# Block packets from private addresses on public interface
sudo iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
sudo iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
sudo iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
sudo iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DROP

Brute Force Protection

# Limit SSH connection attempts
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

# Allow after rate limit
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

Saving and Restoring Rules

Ubuntu/Debian

Install iptables-persistent:

sudo apt update
sudo apt install iptables-persistent

Save rules:

sudo netfilter-persistent save
# Or manually
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6

Restore rules:

sudo netfilter-persistent reload
# Or manually
sudo iptables-restore < /etc/iptables/rules.v4

CentOS/RHEL/Rocky Linux

Install iptables-services:

sudo dnf install iptables-services
sudo systemctl enable iptables

Save rules:

sudo service iptables save
# Or
sudo iptables-save > /etc/sysconfig/iptables

Restore rules:

sudo systemctl restart iptables
# Or
sudo iptables-restore < /etc/sysconfig/iptables

Manual Save/Restore

# Save current rules
sudo iptables-save > /root/iptables-backup-$(date +%F).rules

# Restore from file
sudo iptables-restore < /root/iptables-backup-2024-01-11.rules

# Test before applying permanently
sudo iptables-restore --test < /root/iptables-backup-2024-01-11.rules

Troubleshooting iptables

Common Issues

Locked out via SSH:

# Prevention: Always allow SSH before setting DROP policy
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -P INPUT DROP

# Recovery: Access via console/KVM and flush rules
sudo iptables -F
sudo iptables -P INPUT ACCEPT

Rules not working:

# Check rule order (rules processed top to bottom)
sudo iptables -L --line-numbers

# Verify rule syntax
sudo iptables -C INPUT -p tcp --dport 80 -j ACCEPT

# Check counters
sudo iptables -L -v -n
# Zero counters and retest
sudo iptables -Z

Connection tracking issues:

# Check conntrack table
sudo conntrack -L

# Increase conntrack table size
sudo sysctl -w net.netfilter.nf_conntrack_max=131072

# View current connections
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max

Debugging Tools

Enable packet tracing:

# Install conntrack tools
sudo apt install conntrack

# Enable raw table logging
sudo iptables -t raw -A PREROUTING -p tcp --dport 80 -j TRACE
sudo iptables -t raw -A OUTPUT -p tcp --dport 80 -j TRACE

# View trace in logs
sudo tail -f /var/log/kern.log | grep TRACE

Test rules:

# Use nc to test port accessibility
nc -zv server-ip 80

# From remote host
telnet server-ip 80

Best Practices

1. Always Allow Loopback

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

2. Allow Established Connections Early

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

3. Use Explicit Rules Before Default Policy

# Allow what you need
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Then deny everything else
sudo iptables -P INPUT DROP

4. Comment Your Rules

sudo iptables -A INPUT -p tcp --dport 22 -m comment --comment "Allow SSH" -j ACCEPT

5. Test Before Applying

# Create script with timeout rollback
#!/bin/bash
iptables-restore < /root/new-rules.txt
sleep 60
iptables-restore < /root/known-good-rules.txt

6. Document Your Configuration

Maintain documentation including:

Rule purposes
Change history
Security policies
Troubleshooting notes

7. Regular Backups

# Automated backup script
#!/bin/bash
BACKUP_DIR="/root/iptables-backups"
mkdir -p $BACKUP_DIR
iptables-save > $BACKUP_DIR/iptables-$(date +%Y%m%d-%H%M%S).rules
# Keep only last 30 days
find $BACKUP_DIR -name "iptables-*.rules" -mtime +30 -delete

Add to cron:

0 2 * * * /root/backup-iptables.sh

Complete Production Firewall Example

#!/bin/bash
# production-firewall.sh

# Flush all rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t mangle -F

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Loopback
iptables -A INPUT -i lo -j ACCEPT

# Established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Invalid packets
iptables -A INPUT -m state --state INVALID -j DROP

# SSH with rate limiting
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH brute force: "
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# HTTP/HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# ICMP (ping) with rate limit
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Protection against attacks
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# Log dropped packets
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Save rules
netfilter-persistent save

echo "Firewall configured and saved"

Conclusion

iptables remains a powerful, flexible, and widely-deployed firewall solution for Linux systems. While newer tools like nftables and firewalld offer simplified interfaces, understanding iptables provides deep insights into packet filtering, NAT, connection tracking, and network security that apply across diverse environments and tools.

Key takeaways:

Tables organize rules by function (filter, nat, mangle)
Chains define traffic direction (INPUT, OUTPUT, FORWARD)
Stateful filtering enhances security and performance
NAT capabilities enable routing and port forwarding
Custom chains organize complex rulesets
Logging and monitoring support troubleshooting
Security hardening protects against common attacks
Persistence requires saving rules for reboot survival

Master iptables to build secure, efficient firewall configurations for servers, gateways, and complex network architectures. The skills and concepts learned through iptables provide a foundation for understanding modern packet filtering systems and network security principles.

For further learning, explore nftables as the modern successor, firewalld for higher-level management, and integration with fail2ban for dynamic blocking based on log analysis.

iptables Configuration: Complete Guide

iptables Configuration: Complete Guide

Introduction

Understanding iptables Architecture

Netfilter Framework

Tables

Chains

Packet Flow Through iptables

Rule Structure

Prerequisites

Check iptables Installation

Basic iptables Commands

Viewing Rules

Adding Rules

Deleting Rules

Setting Default Policies

Basic Firewall Configuration

Simple Allow SSH Access

Web Server Configuration

Complete Basic Firewall Script

Advanced Matching Criteria

Protocol Matching

Port Matching

IP Address Matching

Interface Matching

State Matching (Connection Tracking)

Time-Based Rules

Rate Limiting

MAC Address Matching

Network Address Translation (NAT)

Source NAT (SNAT) / Masquerading

Destination NAT (DNAT) / Port Forwarding

Complete NAT Router Configuration

Logging

Basic Logging

Rate-Limited Logging

Log Specific Events

View iptables Logs

User-Defined Chains

Creating Custom Chains

Organizing Complex Rulesets

Security Hardening

Protect Against Common Attacks

Brute Force Protection

Saving and Restoring Rules

Ubuntu/Debian

CentOS/RHEL/Rocky Linux

Manual Save/Restore

Troubleshooting iptables

Common Issues

Debugging Tools

Best Practices

1. Always Allow Loopback

2. Allow Established Connections Early

3. Use Explicit Rules Before Default Policy

4. Comment Your Rules

5. Test Before Applying

6. Document Your Configuration

7. Regular Backups

Complete Production Firewall Example

Conclusion

Latest Video

Get $20 Free Credit