iptables Documentation
This documentation provides a quick reference for managing Linux firewalls with iptables. It covers viewing firewall rules, setting default policies, allowing and blocking ports and IP addresses, removing rules, configuring NAT, saving firewall rules, and troubleshooting firewall configurations.
All commands use a VS Code–styled terminal theme for consistency. Most commands require root or sudo privileges.
Introduction
iptables is a Linux command-line firewall utility used to configure packet filtering, network address translation (NAT), and traffic rules. It operates through tables, chains, and rules that determine how network traffic is handled.
Common built-in chains include:
- INPUT — controls traffic coming into the server.
- OUTPUT — controls traffic leaving the server.
- FORWARD — controls traffic routed through the server.
Installation & Verification
Many Linux distributions already include iptables or provide it through their standard package manager.
sudo apt update
sudo apt install iptables
# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install iptables
# Verify installation
iptables --version
# Check iptables command location
which iptables
View Firewall Rules
sudo iptables -L
# List rules with numbers
sudo iptables -L --line-numbers
# Display rules with numeric addresses and ports
sudo iptables -L -n
# Display verbose information and packet counters
sudo iptables -L -v -n
# View INPUT rules only
sudo iptables -L INPUT -v -n
# View NAT rules
sudo iptables -t nat -L -v -n
Default Policies
Default policies determine what happens to traffic when no matching rule is found.
sudo iptables -L -n
# Allow incoming traffic by default
sudo iptables -P INPUT ACCEPT
# Block incoming traffic by default
sudo iptables -P INPUT DROP
# Allow outgoing traffic by default
sudo iptables -P OUTPUT ACCEPT
# Block forwarded traffic by default
sudo iptables -P FORWARD DROP ```
Allow Ports
Use the -p tcp option for TCP services and specify the destination port with --dport.
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow HTTP
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Allow HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Allow DNS
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT
# Allow a custom TCP port
sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
# Allow a range of TCP ports
sudo iptables -A INPUT -p tcp --dport 8000:8100 -j ACCEPT
Allow IP Addresses
sudo iptables -A INPUT -s 192.168.1.100 -j ACCEPT
# Allow SSH from a specific IP only
sudo iptables -A INPUT -p tcp --dport 22 -s 192.168.1.100 -j ACCEPT
# Allow an entire subnet
sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
# Allow HTTP from a specific subnet
sudo iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
Block Traffic
sudo iptables -A INPUT -s 203.0.113.50 -j DROP
# Reject traffic from a specific IP
sudo iptables -A INPUT -s 203.0.113.50 -j REJECT
# Block a specific TCP port
sudo iptables -A INPUT -p tcp --dport 23 -j DROP
# Block a specific UDP port
sudo iptables -A INPUT -p udp
Remove Firewall Rules
sudo iptables -L INPUT --line-numbers
# Delete rule number 3 from INPUT
sudo iptables -D INPUT 3
# Delete a rule by specifying the complete rule
sudo iptables -D INPUT -p tcp --dport 8080 -j ACCEPT
NAT & Port Forwarding
iptables can also perform Network Address Translation (NAT). The following examples are commonly used for routers, gateways, and Linux servers that forward traffic.
sudo sysctl -w net.ipv4.ip_forward=1
# Enable NAT / masquerading on interface eth0
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Forward HTTP traffic to an internal server
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 \
-j DNAT --to-destination 192.168.1.10:80
# Allow forwarded HTTP traffic
sudo iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT
Save & Restore Rules
iptables rules are normally stored in the kernel and may disappear after a reboot unless they are saved and restored by an appropriate service.
sudo iptables-save | sudo tee /etc/iptables/rules.v4
# Restore rules from a file
sudo iptables-restore < /etc/iptables/rules.v4
# Debian / Ubuntu: install persistence support
sudo apt install iptables-persistent
# Save IPv4 rules using netfilter-persistent
sudo netfilter-persistent save
# Reload saved rules
sudo netfilter-persistent reload
Firewall Logging
sudo iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROP: "
# Log with a limited rate
sudo iptables -A INPUT -m limit --limit 5/min -j LOG \
--log-prefix "IPTABLES-DROP: " --log-level 4
# View kernel messages containing iptables logs
sudo journalctl -k | grep IPTABLES
Flush & Reset Rules
Flushing rules removes the configured rules from the selected table or chain. Use these commands carefully, especially on remote servers.
sudo iptables -F INPUT
# Flush all rules from the filter table
sudo iptables -F
# Delete all user-defined chains
sudo iptables -X
# Flush NAT rules
sudo iptables -t nat -F
# Flush NAT user-defined chains
sudo iptables -t nat -X
Important Notes
- Most iptables commands require sudo or root privileges.
- Rules are evaluated in order from top to bottom.
- Use sudo iptables -L --line-numbers before deleting a rule by number.
- Always allow required SSH access before applying a restrictive INPUT policy on a remote server.
- Changing firewall rules on a remote server can disconnect your SSH session.
- iptables rules may not survive a reboot unless they are saved and restored.
- DROP silently discards traffic, while REJECT actively responds that the traffic is not allowed.
- Use iptables -n to avoid DNS lookups when displaying rules.
- Check packet counters with iptables -L -v -n when troubleshooting.
- Modern Linux distributions may use the nftables framework underneath the iptables command.
- Test firewall changes carefully before closing your current administrative session.