Configuring a firewall using iptables

Configuring a firewall using iptables
Learn how to set up a basic firewall using iptables to allow or block access to specific services and IP addresses on your server.

This article explains how to configure a basic firewall using iptables. You can explicitly grant or deny access to selected services on your server and control which IP addresses can connect.

About iptables
Iptables allows you to view and modify Linux kernel packet filtering capabilities. You can grant or deny access to specific network services (like SSH or HTTP) and permit or block certain IP addresses.

Rules are grouped into chains. By default, iptables uses three chains:

INPUT: Incoming packets
FORWARD: Forwarded packets
OUTPUT: Outgoing packets

This guide focuses on the INPUT chain to selectively allow or block incoming packets. Iptables is included by default in most major Linux distributions, including Debian, Ubuntu, AlmaLinux, and Fedora.

Adding rules
By default, iptables has no rules. Verify this on a new server with:

iptables -L

Typical output:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

To add basic rules, run:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

Explanation of commands:

The first command allows all packets on the local loopback interface.
The second command accepts packets belonging to an existing or related connection.
The third command permits incoming SSH (TCP port 22) connections.
The last command drops packets that do not match previous rules.

Important
Use the correct SSH port for your account. Some hosting accounts use custom ports, e.g., 7822.

After running iptables -L, the output should look like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:22
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Test the configuration by connecting via SSH. Other ports, like HTTP (port 80), will be blocked.

Inserting rules
If you want to allow more services, you cannot simply append rules after the DROP rule. Use the -I option to insert rules at a specific position.

For example, to allow HTTP (port 80) before the DROP rule:

iptables -I INPUT 4 -p tcp -m tcp --dport 80 -j ACCEPT

The DROP rule is now pushed to line five. Running iptables -L will show:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:22
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
DROP       all  --  anywhere             anywhere
Tip

\
View line numbers for all rules with:

iptables -L --line-numbers

Blocking an IP address
To block repeated malicious connections, insert a rule for the IP address:

iptables -I INPUT rulenum -s xxx.xxx.xxx.xxx -p tcp -m tcp --dport 22 -j DROP

To block all traffic from an IP address regardless of service:

iptables -I INPUT rulenum -s xxx.xxx.xxx.xxx -j DROP

Deleting rules
Delete a specific rule by its line number:

iptables -D INPUT 5

Delete all rules at once:

iptables -F

Saving rules
Without saving, rules are lost after reboot.

Debian/Ubuntu:

apt-get install iptables-persistent

During installation, press Enter at the prompts to save IPv4 and IPv6 rules. For subsequent changes:

iptables-save > /etc/iptables/rules.v4

AlmaLinux/Fedora:

/sbin/service iptables save

More information
This is a brief introduction to iptables. For full details, run:

man iptables