Iptables: Common Firewall Rules and Commands

Iptables is a powerful firewall utility that is used to secure Linux systems from unauthorized network traffic. It is a command-line tool that provides a flexible and customizable way to configure and manage firewall rules. In this article, we will cover the essentials of Iptables, including some of the most common firewall rules and commands.

Before we dive into the details of Iptables, it is essential to understand the basics of how it works. Iptables is based on the concept of packet filtering, which involves examining each incoming or outgoing packet and deciding whether to allow or block it based on predefined rules. The rules are organized into chains, which are sets of rules that apply to packets at different stages of their journey through the system.

Advertisement

Basics

The Iptables command syntax follows a basic structure of:

The -t option specifies the table to which the command applies. The default table is the filter table, which is used for packet filtering. Other tables include nat for network address translation and mangle for packet modification.

Here are some of the most commonly used Iptables commands:

• -A (append): Adds a new rule to the end of a chain.
• -D (delete): Deletes a rule from a chain.
• -I (insert): Inserts a new rule at a specific position in a chain.
• -L (list): Lists the rules in a chain.
• -F (flush): Deletes all the rules in a chain.

Common Iptables Rules with Commands

Now, let’s look at some of the most commonly used Iptables firewall rules:

Block incoming traffic on a specific port:

iptables -A INPUT -p tcp --dport <port number> -j DROP

1	iptables -A INPUT -p tcp --dport <port number> -j DROP

This rule blocks all incoming traffic on the specified port number by adding it to the end of the INPUT chain and using the DROP action.

Allow incoming traffic on a specific port:

iptables -A INPUT -p tcp --dport <port number> -j ACCEPT

1	iptables -A INPUT -p tcp --dport <port number> -j ACCEPT

This rule allows incoming traffic on the specified port number by adding it to the end of the INPUT chain and using the ACCEPT action.

Block outgoing traffic to a specific IP address:

iptables -A OUTPUT -d <IP address> -j DROP

1	iptables -A OUTPUT -d <IP address> -j DROP

This rule blocks all outgoing traffic to the specified IP address by adding it to the end of the OUTPUT chain and using the DROP action.

Allow outgoing traffic to a specific IP address:

iptables -A OUTPUT -d <IP address> -j ACCEPT

1	iptables -A OUTPUT -d <IP address> -j ACCEPT

This rule allows outgoing traffic to the specified IP address by adding it to the end of the OUTPUT chain and using the ACCEPT action.

Block traffic from a specific IP address:

iptables -A INPUT -s <IP address> -j DROP

1	iptables -A INPUT -s <IP address> -j DROP

This rule blocks all incoming traffic from the specified IP address by adding it to the end of the INPUT chain and using the DROP action.

Allow traffic from a specific IP address:

iptables -A INPUT -s <IP address> -j ACCEPT

1	iptables -A INPUT -s <IP address> -j ACCEPT

This rule allows incoming traffic from the specified IP address by adding it to the end of the INPUT chain and using the ACCEPT action.

Block all incoming traffic except for established connections:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -j DROP

1 2	iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -j DROP

This rule allows incoming traffic for established connections by adding it to the end of the INPUT chain and using the ACCEPT action with the conntrack module. The second rule drops all incoming traffic that does not match the first rule.

Allow incoming SSH traffic:

iptables -A INPUT -p tcp --dport ssh -j ACCEPT

1	iptables -A INPUT -p tcp --dport ssh -j ACCEPT

This rule allows incoming SSH traffic by adding it to the end of the INPUT chain and using the ACCEPT action with the tcp protocol and the ssh port number.

Block incoming ICMP traffic:

iptables -A INPUT -p icmp -j DROP

1	iptables -A INPUT -p icmp -j DROP

This rule blocks all incoming ICMP traffic by adding it to the end of the INPUT chain and using the DROP action with the icmp protocol.

Block all incoming traffic from a specific country:

iptables -A INPUT -m geoip --src-cc <country code> -j DROP

1	iptables -A INPUT -m geoip --src-cc <country code> -j DROP

This rule blocks all incoming traffic from the specified country by adding it to the end of the INPUT chain and using the DROP action with the geoip module.

These are just a few examples of the many possible Iptables firewall rules. The possibilities are virtually endless, and it’s essential to have a solid understanding of your network’s needs and potential threats to create effective firewall rules.

In conclusion, Iptables is a powerful tool that provides a customizable way to configure and manage firewall rules on Linux systems. With the right rules and commands, you can secure your network from unauthorized traffic and potential threats.