< h2 align = "center" > Iptables Essentials: Common Firewall Rules and Commands< / h2 >
< br >
< p align = "center" >
< a href = "https://github.com/trimstray/iptables-essentials/tree/master" >
< img src = "https://img.shields.io/badge/Branch-master-green.svg?longCache=true"
alt="Branch">
< / a >
< a href = "http://www.gnu.org/licenses/" >
< img src = "https://img.shields.io/badge/License-GNU-blue.svg?longCache=true"
alt="License">
< / a >
< / p >
< div align = "center" >
< sub > Created by
< a href = "https://twitter.com/trimstray" > trimstray< / a > and
< a href = "https://github.com/trimstray/iptables-essentials/graphs/contributors" >
contributors
< / a >
< / div >
< br >
< p align = "center" >
Found on the Internet - All in One List.
< / p >
## :ballot_box_with_check: Todo
- [ ] Add useful Iptables configuration examples
- [ ] Add links to useful external resources
- [ ] Add advanced configuration examples, commands, rules
****
## Table Of Content
- [Tools to help you configure Iptables ](#tools-to-help-you-configure-iptables )
- [Manuals/Howtos/Tutorials ](#manuals-howtos-tutorials )
- [Iptables Rules ](#iptables-rules )
* [Saving Rules ](#saving-rules )
* [List out all of the active iptables rules with verbose ](#list-out-all-of-the-active-iptables-rules-with-verbose )
* [List out all of the active iptables rules with numeric lines and verbose ](#list-out-all-of-the-active-iptables-rules-with-numeric-lines-and-verbose )
* [Print out all of the active iptables rules ](#print-out-all-of-the-active-iptables-rules )
* [List Rules as Tables for INPUT chain ](#list-rules-as-tables-for-input-chain )
* [Print all of the rule specifications in the INPUT chain ](#print-all-of-the-rule-specifications-in-the-input-chain )
* [Show Packet Counts and Aggregate Size ](#show-packet-counts-and-aggregate-size )
* [To display INPUT or OUTPUT chain rules with numeric lines and verbose ](#to-display-input-or-output-chain-rules-with-numeric-lines-and-verbose )
* [Delete Rule by Chain and Number ](#delete-rule-by-chain-and-number )
* [Delete Rule by Specification ](#delete-rule-by-specification )
* [Flush All Rules, Delete All Chains, and Accept All ](#flush-all-rules--delete-all-chains--and-accept-all )
* [Flush All Chains ](#flush-all-chains )
* [Flush a Single Chain ](#flush-a-single-chain )
* [Insert Firewall Rules ](#insert-firewall-rules )
* [Allow Loopback Connections ](#allow-loopback-connections )
* [Allow Established and Related Incoming Connections ](#allow-established-and-related-incoming-connections )
* [Allow Established Outgoing Connections ](#allow-established-outgoing-connections )
* [Internal to External ](#internal-to-external )
* [Drop Invalid Packets ](#drop-invalid-packets )
* [Block an IP Address ](#block-an-ip-address )
* [Block and IP Address and Reject ](#block-and-ip-address-and-reject )
* [Block Connections to a Network Interface ](#block-connections-to-a-network-interface )
* [Block Connections to a Network Interface ](#block-connections-to-a-network-interface-1 )
* [Allow All Incoming SSH ](#allow-all-incoming-ssh )
* [Allow Incoming SSH from Specific IP address or subnet ](#allow-incoming-ssh-from-specific-ip-address-or-subnet )
* [Allow Outgoing SSH ](#allow-outgoing-ssh )
* [Allow Incoming Rsync from Specific IP Address or Subnet ](#allow-incoming-rsync-from-specific-ip-address-or-subnet )
* [Allow All Incoming HTTP ](#allow-all-incoming-http )
* [Allow All Incoming HTTPS ](#allow-all-incoming-https )
* [Allow All Incoming HTTP and HTTPS ](#allow-all-incoming-http-and-https )
* [Allow MySQL from Specific IP Address or Subnet ](#allow-mysql-from-specific-ip-address-or-subnet )
* [Allow MySQL to Specific Network Interface ](#allow-mysql-to-specific-network-interface )
* [PostgreSQL from Specific IP Address or Subnet ](#postgresql-from-specific-ip-address-or-subnet )
* [Allow PostgreSQL to Specific Network Interface ](#allow-postgresql-to-specific-network-interface )
* [Block Outgoing SMTP Mail ](#block-outgoing-smtp-mail )
* [Allow All Incoming SMTP ](#allow-all-incoming-smtp )
* [Allow All Incoming IMAP ](#allow-all-incoming-imap )
* [Allow All Incoming IMAPS ](#allow-all-incoming-imaps )
* [Allow All Incoming POP3 ](#allow-all-incoming-pop3 )
* [Allow All Incoming POP3S ](#allow-all-incoming-pop3s )
* [Drop Private Network Address On Public Interface ](#drop-private-network-address-on-public-interface )
* [Only Block Incoming Traffic ](#only-block-incoming-traffic )
* [Drop All Outgoing to Facebook Networks ](#drop-all-outgoing-to-facebook-networks )
* [Log and Drop Packets ](#log-and-drop-packets )
* [Log and Drop Packets with Limited Number of Log Entries ](#log-and-drop-packets-with-limited-number-of-log-entries )
* [Drop or Accept Traffic From Mac Address ](#drop-or-accept-traffic-from-mac-address )
* [Block or Allow ICMP Ping Request ](#block-or-allow-icmp-ping-request )
****
### Tools to help you configure Iptables
< p >
:small_orange_diamond: < a href = "http://shorewall.org/" > < b > Shorewall< / b > < / a > - advanced gateway/firewall configuration tool for GNU/Linux.< br >
:small_orange_diamond: < a href = "https://firewalld.org/" > < b > Firewalld< / b > < / a > - provides a dynamically managed firewall.< br >
:small_orange_diamond: < a href = "https://wiki.ubuntu.com/UncomplicatedFirewall" > < b > UFW< / b > < / a > - default firewall configuration tool for Ubuntu.< br >
:small_orange_diamond: < a href = "https://github.com/firehol/firehol" > < b > FireHOL< / b > < / a > - offer simple and powerful configuration for all Linux firewall and traffic shaping requirements.< br >
< / p >
### Manuals/Howtos/Tutorials
< p >
:small_orange_diamond: < a href = "https://major.io/2010/04/12/best-practices-iptables/" > < b > Best practices: iptables - by Major Hayden< / b > < / a > < br >
:small_orange_diamond: < a href = "https://www.booleanworld.com/depth-guide-iptables-linux-firewall/" > < b > An In-Depth Guide to Iptables, the Linux Firewall< / b > < / a > < br >
:small_orange_diamond: < a href = "https://linuxgazette.net/108/odonovan.html" > < b > Advanced Features of netfilter/iptables< / b > < / a > < br >
< / p >
### Iptables Rules
#### Saving Rules
###### Debian Based
```bash
netfilter-persistent save
```
###### RedHat Based
```bash
service iptables save
```
#### List out all of the active iptables rules with verbose
```bash
iptables -n -L -v
```
#### List out all of the active iptables rules with numeric lines and verbose
```bash
iptables -n -L -v --line-numbers
```
#### Print out all of the active iptables rules
```bash
iptables -S
```
#### List Rules as Tables for INPUT chain
```bash
iptables -L INPUT
```
#### Print all of the rule specifications in the INPUT chain
```bash
iptables -S INPUT
```
#### Show Packet Counts and Aggregate Size
```bash
iptables -L INPUT -v
```
#### To display INPUT or OUTPUT chain rules with numeric lines and verbose
```bash
iptables -L INPUT -n -v
iptables -L OUTPUT -n -v --line-numbers
```
#### Delete Rule by Chain and Number
```bash
iptables -D INPUT 10
```
#### Delete Rule by Specification
```bash
iptables -D INPUT -m conntrack --ctstate INVALID -j DROP
```
#### Flush All Rules, Delete All Chains, and Accept All
```bash
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
```
#### Flush All Chains
```bash
iptables -F
```
#### Flush a Single Chain
```bash
iptables -F INPUT
```
#### Insert Firewall Rules
```bash
iptables -I INPUT 2 -s 202.54.1.2 -j DROP
```
#### Allow Loopback Connections
```bash
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
```
#### Allow Established and Related Incoming Connections
```bash
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
```
#### Allow Established Outgoing Connections
```bash
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Internal to External
```bash
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
```
#### Drop Invalid Packets
```bash
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
```
#### Block an IP Address
```bash
iptables -A INPUT -s 192.168.252.10 -j DROP
```
#### Block and IP Address and Reject
```bash
iptables -A INPUT -s 192.168.252.10 -j REJECT
```
#### Block Connections to a Network Interface
```bash
iptables -A INPUT -i eth0 -s 192.168.252.10 -j DROP
```
#### Block Connections to a Network Interface
```bash
iptables -A INPUT -i eth0 -s 192.168.252.10 -j DROP
```
#### Allow All Incoming SSH
```bash
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow Incoming SSH from Specific IP address or subnet
```bash
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow Outgoing SSH
```bash
iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow Incoming Rsync from Specific IP Address or Subnet
```bash
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming HTTP
```bash
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming HTTPS
```bash
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming HTTP and HTTPS
```bash
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow MySQL from Specific IP Address or Subnet
```bash
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow MySQL to Specific Network Interface
```bash
iptables -A INPUT -i eth1 -p tcp --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### PostgreSQL from Specific IP Address or Subnet
```bash
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow PostgreSQL to Specific Network Interface
```bash
iptables -A INPUT -i eth1 -p tcp --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Block Outgoing SMTP Mail
```bash
iptables -A OUTPUT -p tcp --dport 25 -j REJECT
```
#### Allow All Incoming SMTP
```bash
iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming IMAP
```bash
iptables -A INPUT -p tcp --dport 143 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 143 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming IMAPS
```bash
iptables -A INPUT -p tcp --dport 993 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 993 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming POP3
```bash
iptables -A INPUT -p tcp --dport 110 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 110 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Allow All Incoming POP3S
```bash
iptables -A INPUT -p tcp --dport 995 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 995 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
#### Drop Private Network Address On Public Interface
```bash
iptables -A INPUT -i eth1 -s 192.168.0.0/24 -j DROP
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
```
#### Only Block Incoming Traffic
```bash
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED -j ACCEPT
```
#### Drop All Outgoing to Facebook Networks
Get Facebook AS:
```bash
whois -h v4.whois.cymru.com " -v $(host facebook.com | grep "has address" | cut -d " " -f4)" | tail -n1 | awk '{print $1}'
```
Drop:
```bash
for i in $(whois -h whois.radb.net -- '-i origin AS32934' | grep "^route:" | cut -d ":" -f2 | sed -e 's/^[ \t]*//' | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | cut -d ":" -f2 | sed 's/$/;/') ; do
iptables -A OUTPUT -s "$i" -j REJECT
done
```
#### Log and Drop Packets
```bash
ptables -A INPUT -i eth1 -s 10.0.0.0/8 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
```
By default everything is logged to `/var/log/messages` file:
```bash
tail -f /var/log/messages
grep --color 'IP SPOOF' /var/log/messages
```
#### Log and Drop Packets with Limited Number of Log Entries
```bash
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
```
#### Drop or Accept Traffic From Mac Address
```bash
iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP
iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source 00:0F:EA:91:04:07 -j ACCEPT
```
#### Block or Allow ICMP Ping Request
```bash
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j DROP
```