Configuring a firewall using iptables
Learn how to set up a basic firewall using iptables to allow or block access to specific services and IP addresses on your server.
This article explains how to configure a basic firewall using iptables. You can explicitly grant or deny access to selected services on your server and control which IP addresses can connect.
| Important Root access is required to follow the steps described in this article. |
About iptables
Iptables allows you to view and modify Linux kernel packet filtering capabilities. You can grant or deny access to specific network services (like SSH or HTTP) and permit or block certain IP addresses.
Rules are grouped into chains. By default, iptables uses three chains:
-
INPUT: Incoming packets
-
FORWARD: Forwarded packets
-
OUTPUT: Outgoing packets
This guide focuses on the INPUT chain to selectively allow or block incoming packets. Iptables is included by default in most major Linux distributions, including Debian, Ubuntu, AlmaLinux, and Fedora.
Adding rules
By default, iptables has no rules. Verify this on a new server with:
iptables -L
Typical output:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destinationTo add basic rules, run:
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROPExplanation of commands:
-
The first command allows all packets on the local loopback interface.
-
The second command accepts packets belonging to an existing or related connection.
-
The third command permits incoming SSH (TCP port 22) connections.
-
The last command drops packets that do not match previous rules.
Important
Use the correct SSH port for your account. Some hosting accounts use custom ports, e.g., 7822.
After running iptables -L, the output should look like this:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:22
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destinationTest the configuration by connecting via SSH. Other ports, like HTTP (port 80), will be blocked.
Inserting rules
If you want to allow more services, you cannot simply append rules after the DROP rule. Use the -I option to insert rules at a specific position.
For example, to allow HTTP (port 80) before the DROP rule:
iptables -I INPUT 4 -p tcp -m tcp --dport 80 -j ACCEPT
The DROP rule is now pushed to line five. Running iptables -L will show:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:22
ACCEPT tcp -- anywhere anywhere tcp dpt:http
DROP all -- anywhere anywhere
Tip
View line numbers for all rules with:
iptables -L --line-numbers
Blocking an IP address
To block repeated malicious connections, insert a rule for the IP address:
iptables -I INPUT rulenum -s xxx.xxx.xxx.xxx -p tcp -m tcp --dport 22 -j DROP
To block all traffic from an IP address regardless of service:
iptables -I INPUT rulenum -s xxx.xxx.xxx.xxx -j DROP
Deleting rules
Delete a specific rule by its line number:
iptables -D INPUT 5
Delete all rules at once:
iptables -F
Saving rules
Without saving, rules are lost after reboot.
Debian/Ubuntu:
apt-get install iptables-persistent
During installation, press Enter at the prompts to save IPv4 and IPv6 rules. For subsequent changes:
iptables-save > /etc/iptables/rules.v4
AlmaLinux/Fedora:
/sbin/service iptables save
More information
This is a brief introduction to iptables. For full details, run:
man iptables
