The Beginners Guide to iptables
Iptables is a firewall utility in Linux that lets you define granular IP packet filter rules for your server. Using these rules, you can effectively control access to your server. It’s a utility that every Linux administrator should master.
In the following article, we’ll share everything you need to get started with iptables. Let’s begin!
What is iptables and how does it work?
Iptables is a command-line interface that lets administrators configure Netfilter, the networking module of the Linux kernel. The packet filtering mechanism of iptables is governed by three entities: tables, chains, and targets.
A table is a collection of chains. Each chain contains a set of packet matching rules that allow you to control how traffic flows in and out of your system. The default table is known as filter. It has three predefined chains:
INPUT: For incoming packets.
FORWARD: For packets that will be relayed through the server to another destination.
OUTPUT: For outgoing packets.
In addition to specifying the matching criterion, a rule also defines a target. A target tells iptables what to do in case a rule is matched. The target value can be:
ACCEPT: Let the packet through.
DROP: Don’t let the packet through.
QUEUE: Used to forward packets to an external program in the user space.
RETURN: Stop the processing of the current chain, and send the packet back to the previous chain.
A user-defined chain: Let the packet be processed by another chain.
For every incoming and outgoing packet, the iptables engine checks all the predefined and user-defined chains, one by one. When it gets a match, it retrieves the target of the matched rule, and executes it. If a match isn’t found, the default policy of the chain is executed.
Installing iptables on Linux
If you don’t have iptables pre-installed on your system, follow the steps below to install it:
sudo apt-get update sudo apt-get install iptables
For Ubuntu and Debian:
sudo apt-get update sudo apt-get install iptables
You can check the status of the currently active iptables configuration using the following command:
sudo iptables -L -v
-L option lists down all the rules, and
-v stands for verbose, which displays detailed information. If you haven’t configured any rules yet, expect an output like this:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
As you can see, all the default chains are set to ACCEPT, and don’t contain any rules. This allows all traffic to flow freely in and out of your system. In the following sections, let’s learn to add rules to these chains.
Understanding iptables syntax
When you add a rule to iptables, it gets appended to a chain. Keep the following command-line options in mind while adding rules:
-A-> append one or more rules to a chain.
-D-> Delete one or more rules from a chain.
-F-> Flush a chain, i.e. remove all its rules.
-N-> Create a new chain.
-i-> Indicates the network interface for which you want to define the rule. E.g.
-s-> The source of the packet. You can either specify a hostname or an IP address.
-p-> The network protocol of the packet. E.g.
sctpetc. You can also specify all here, which filters packets of all protocols.
--dport-> The destination port. E.g.
-j-> The target value, e.g.
RETURN, or the name of a user-defined chain.
Putting it all together, you can use the following syntax to append a rule to an existing chain:
sudo iptables -A <chain_name> -i <interface> -p <protocol> -s <source> --dport <port> -j <target value>
Open traffic on localhost
The first thing you should do is open all traffic on your localhost. This will allow all applications running on your machine to talk to each other and the localhost.
sudo iptables -A INPUT -i lo -j ACCEPT
The above command accepts all traffic destined to the localhost.
Block IPs using iptables
A common use-case of iptables is to block traffic from malicious IPs. The following command will drop all packets coming from 220.127.116.11.
iptables -A INPUT -s 18.104.22.168 -j DROP
You can also block a range of IPs, e.g. the following command will block all traffic from IPs falling within the range 22.214.171.124 – 126.96.36.199.
iptables -A INPUT -s 188.8.131.52/24 -j REJECT
To block outgoing traffic to a specific IP, use the following command:
iptables -A OUTPUT -d 184.108.40.206 -j DROP
-d flag specifies the destination to block.
Enabling/disabling traffic on an interface
To enable traffic on an interface:
sudo iptables -A INPUT -i <interface> -j ACCEPT
sudo iptables -A INPUT -i <interface> -j DROP
Enabling traffic for HTTP, HTTPS, and SSH
To allow remote connections, you should add a rule that allows traffic on the default SSH port, i.e. 22.
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
If you expect to receive HTTP or HTTPS traffic, use the following commands to open the 80 and 443 ports.
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Opening multiple ports
You can also specify multiple ports in the same rule. For example:
sudo iptables -A INPUT -p tcp --match multiport --dports 112,143,883,995 -j ACCEPT
Dropping all other traffic by default
It’s considered a best practice to add explicit rules that only allow authorized traffic to pass through the required ports, and drop all other traffic by default. This ensures that only legitimate traffic is allowed into your system.
Once you have defined all the explicit
-dport rules, use this command to drop everything else:
sudo iptables -A INPUT -j DROP
Use the following command to clear your iptables, removing all rules.
sudo iptables -F
To delete a specific rule from a chain, you need to enter the name of the chain, and the rule number. You can get the rule number using this command:
sudo iptables -L OUTPUT -line-numbers
OUTPUT is the name of the chain. Expect an output like the following:
Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all - 192.168.1.3 anywhere 2 ACCEPT tcp - anywhere anywhere tcp dpt:https 3 ACCEPT tcp - anywhere anywhere tcp dpt:ssh 4 ACCEPT tcp - anywhere anywhere tcp dpt:5421 5 ACCEPT udp - anywhere anywhere udp dpt:23
If we want to delete rule # 5 from the input chain, we can use this command:
sudo iptables -D INPUT 5
Alternatively, if you want to flush a chain (remove all its rules), you can use:
iptables -flush CUSTOMCHAIN
If you make a mistake while defining a rule, you can replace it using the
-R option. The following command replaces rule # 3 of the
iptables -R INPUT 3 -s 220.127.116.11 -j ACCEPT
Persisting iptables across restarts
Any changes you make to iptables only get saved in memory. They aren’t written to disk by default. This means that you will have to redefine them on every restart. Fortunately, you can use the following built-in utility to persist your iptables configurations across restarts.
Make sure to run the above command each time you change something in your iptables.