# Configuring a firewall using iptables

> Set up a basic iptables firewall on a server to allow or block access to specific services and IP addresses.

Source: https://helpcenter.ruachost.com/developers/linux/configuring-a-firewall-using-iptables/

**Configuring a firewall using iptables**\
Learn how to set up a basic firewall using iptables to allow or block access to specific services and IP addresses on your server.

This article explains how to configure a basic firewall using iptables. You can explicitly grant or deny access to selected services on your server and control which IP addresses can connect.

> **Caution:**
Root access is required to follow the steps described in this article.

**About iptables**\
Iptables allows you to view and modify Linux kernel packet filtering capabilities. You can grant or deny access to specific network services (like SSH or HTTP) and permit or block certain IP addresses.

Rules are grouped into chains. By default, iptables uses three chains:

- **INPUT**: Incoming packets
- **FORWARD**: Forwarded packets
- **OUTPUT**: Outgoing packets

This guide focuses on the INPUT chain to selectively allow or block incoming packets. Iptables is included by default in most major Linux distributions, including Debian, Ubuntu, AlmaLinux, and Fedora.

**Adding rules**\
By default, iptables has no rules. Verify this on a new server with:

```
iptables -L
```

Typical output:

```
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
```

To add basic rules, run:

```
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP
```

Explanation of commands:

- The first command allows all packets on the local loopback interface.
- The second command accepts packets belonging to an existing or related connection.
- The third command permits incoming SSH (TCP port 22) connections.
- The last command drops packets that do not match previous rules.

**Important**\
Use the correct SSH port for your account. Some hosting accounts use custom ports, e.g., 7822.

After running `iptables -L`, the output should look like this:

```
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:22
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
```

Test the configuration by connecting via SSH. Other ports, like HTTP (port 80), will be blocked.

**Inserting rules**\
If you want to allow more services, you cannot simply append rules after the DROP rule. Use the `-I` option to insert rules at a specific position.

For example, to allow HTTP (port 80) before the DROP rule:

```
iptables -I INPUT 4 -p tcp -m tcp --dport 80 -j ACCEPT
```

The DROP rule is now pushed to line five. Running `iptables -L` will show:

```
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:22
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
DROP       all  --  anywhere             anywhere
Tip
```

```
\
View line numbers for all rules with:
```

```
iptables -L --line-numbers
```

**Blocking an IP address**\
To block repeated malicious connections, insert a rule for the IP address:

```
iptables -I INPUT rulenum -s xxx.xxx.xxx.xxx -p tcp -m tcp --dport 22 -j DROP
```

To block all traffic from an IP address regardless of service:

```
iptables -I INPUT rulenum -s xxx.xxx.xxx.xxx -j DROP
```

**Deleting rules**\
Delete a specific rule by its line number:

```
iptables -D INPUT 5
```

Delete all rules at once:

```
iptables -F
```

**Saving rules**\
Without saving, rules are lost after reboot.

*Debian/Ubuntu:*

```
apt-get install iptables-persistent
```

During installation, press Enter at the prompts to save IPv4 and IPv6 rules. For subsequent changes:

```
iptables-save > /etc/iptables/rules.v4
```

*AlmaLinux/Fedora:*

```
/sbin/service iptables save
```

**More information**\
This is a brief introduction to iptables. For full details, run:

```
man iptables
```