Iptables Essentials: Common Firewall Rules and Commands

_{Created by trimstray and contributors}

Found on the Internet - All in One List.

☑️ Todo

• Add useful Iptables configuration examples
• Add links to useful external resources
• Add advanced configuration examples, commands, rules

---

Table Of Content

• Tools to help you configure Iptables
• Manuals/Howtos/Tutorials
• Iptables Rules
  • Saving Rules
  • List out all of the active iptables rules with verbose
  • List out all of the active iptables rules with numeric lines and verbose
  • Print out all of the active iptables rules
  • List Rules as Tables for INPUT chain
  • Print all of the rule specifications in the INPUT chain
  • Show Packet Counts and Aggregate Size
  • To display INPUT or OUTPUT chain rules with numeric lines and verbose
  • Delete Rule by Chain and Number
  • Delete Rule by Specification
  • Flush All Rules, Delete All Chains, and Accept All
  • Flush All Chains
  • Flush a Single Chain
  • Insert Firewall Rules
  • Allow Loopback Connections
  • Allow Established and Related Incoming Connections
  • Allow Established Outgoing Connections
  • Internal to External
  • Drop Invalid Packets
  • Block an IP Address
  • Block and IP Address and Reject
  • Block Connections to a Network Interface
  • Block Connections to a Network Interface
  • Allow All Incoming SSH
  • Allow Incoming SSH from Specific IP address or subnet
  • Allow Outgoing SSH
  • Allow Incoming Rsync from Specific IP Address or Subnet
  • Allow All Incoming HTTP
  • Allow All Incoming HTTPS
  • Allow All Incoming HTTP and HTTPS
  • Allow MySQL from Specific IP Address or Subnet
  • Allow MySQL to Specific Network Interface
  • PostgreSQL from Specific IP Address or Subnet
  • Allow PostgreSQL to Specific Network Interface
  • Block Outgoing SMTP Mail
  • Allow All Incoming SMTP
  • Allow All Incoming IMAP
  • Allow All Incoming IMAPS
  • Allow All Incoming POP3
  • Allow All Incoming POP3S
  • Drop Private Network Address On Public Interface
  • Only Block Incoming Traffic
  • Drop All Outgoing to Facebook Networks
  • Log and Drop Packets
  • Log and Drop Packets with Limited Number of Log Entries
  • Drop or Accept Traffic From Mac Address
  • Block or Allow ICMP Ping Request

---

Tools to help you configure Iptables

  🔸 Shorewall - advanced gateway/firewall configuration tool for GNU/Linux.
  🔸 Firewalld - provides a dynamically managed firewall.
  🔸 UFW - default firewall configuration tool for Ubuntu.
  🔸 FireHOL - offer simple and powerful configuration for all Linux firewall and traffic shaping requirements.

Manuals/Howtos/Tutorials

  🔸 Best practices: iptables - by Major Hayden
  🔸 An In-Depth Guide to Iptables, the Linux Firewall
  🔸 Advanced Features of netfilter/iptables

Iptables Rules

Saving Rules

Debian Based

netfilter-persistent save

RedHat Based

service iptables save

List out all of the active iptables rules with verbose

iptables -n -L -v

List out all of the active iptables rules with numeric lines and verbose

iptables -n -L -v --line-numbers

Print out all of the active iptables rules

iptables -S

List Rules as Tables for INPUT chain

iptables -L INPUT

Print all of the rule specifications in the INPUT chain

iptables -S INPUT

Show Packet Counts and Aggregate Size

iptables -L INPUT -v

To display INPUT or OUTPUT chain rules with numeric lines and verbose

iptables -L INPUT -n -v
iptables -L OUTPUT -n -v --line-numbers

Delete Rule by Chain and Number

iptables -D INPUT 10

Delete Rule by Specification

iptables -D INPUT -m conntrack --ctstate INVALID -j DROP

Flush All Rules, Delete All Chains, and Accept All

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

Flush All Chains

iptables -F

Flush a Single Chain

iptables -F INPUT

Insert Firewall Rules

iptables -I INPUT 2 -s 202.54.1.2 -j DROP

Allow Loopback Connections

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

Allow Established and Related Incoming Connections

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow Established Outgoing Connections

iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

Internal to External

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Drop Invalid Packets

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

Block an IP Address

iptables -A INPUT -s 192.168.252.10 -j DROP

Block and IP Address and Reject

iptables -A INPUT -s 192.168.252.10 -j REJECT

Block Connections to a Network Interface

iptables -A INPUT -i eth0 -s 192.168.252.10 -j DROP

Block Connections to a Network Interface

iptables -A INPUT -i eth0 -s 192.168.252.10 -j DROP

Allow All Incoming SSH

iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow Incoming SSH from Specific IP address or subnet

iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow Outgoing SSH

iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow Incoming Rsync from Specific IP Address or Subnet

iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming HTTP

iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming HTTPS

iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming HTTP and HTTPS

iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow MySQL from Specific IP Address or Subnet

iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow MySQL to Specific Network Interface

iptables -A INPUT -i eth1 -p tcp --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

PostgreSQL from Specific IP Address or Subnet

iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow PostgreSQL to Specific Network Interface

iptables -A INPUT -i eth1 -p tcp --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Block Outgoing SMTP Mail

iptables -A OUTPUT -p tcp --dport 25 -j REJECT

Allow All Incoming SMTP

iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming IMAP

iptables -A INPUT -p tcp --dport 143 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 143 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming IMAPS

iptables -A INPUT -p tcp --dport 993 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 993 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming POP3

iptables -A INPUT -p tcp --dport 110 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 110 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming POP3S

iptables -A INPUT -p tcp --dport 995 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 995 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Drop Private Network Address On Public Interface

iptables -A INPUT -i eth1 -s 192.168.0.0/24 -j DROP
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

Only Block Incoming Traffic

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED -j ACCEPT

Drop All Outgoing to Facebook Networks

Get Facebook AS:

whois -h v4.whois.cymru.com " -v $(host facebook.com | grep "has address" | cut -d " " -f4)" | tail -n1 | awk '{print $1}'

Drop:

for i in $(whois -h whois.radb.net -- '-i origin AS32934' | grep "^route:" | cut -d ":" -f2 | sed -e 's/^[ \t]*//' | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | cut -d ":" -f2 | sed 's/$/;/') ; do

  iptables -A OUTPUT -s "$i" -j REJECT

done

Log and Drop Packets

iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

By default everything is logged to /var/log/messages file:

tail -f /var/log/messages
grep --color 'IP SPOOF' /var/log/messages

Log and Drop Packets with Limited Number of Log Entries

iptables -A INPUT -i eth1 -s 10.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

Drop or Accept Traffic From Mac Address

iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP
iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source 00:0F:EA:91:04:07 -j ACCEPT

Block or Allow ICMP Ping Request

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j DROP