Iptables Commands

Linux firewall rules and iptables/nftables commands.

Viewing Rules

iptables -L

List all rules in all chains

iptables -L -v

List rules with verbose output

iptables -L -n

List rules without DNS resolution

iptables -L -v -n --line-numbers

List rules with line numbers

iptables -t nat -L -v -n

List NAT table rules

iptables -S

Show all rules as commands

iptables -S INPUT

Show INPUT chain rules as commands

Basic Filtering

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Allow SSH connections

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Allow HTTP traffic

iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Allow HTTPS traffic

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Allow traffic from subnet

iptables -A INPUT -i lo -j ACCEPT

Allow loopback traffic

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow established connections

Blocking Traffic

iptables -A INPUT -s 10.0.0.5 -j DROP

Block traffic from specific IP

iptables -A INPUT -s 10.0.0.0/24 -j DROP

Block traffic from subnet

iptables -A INPUT -p tcp --dport 23 -j DROP

Block Telnet port

iptables -A INPUT -p icmp -j DROP

Block ICMP (ping) traffic

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.5 -j DROP

Block SSH from specific IP

iptables -A OUTPUT -d 192.168.1.100 -j DROP

Block outbound traffic to IP

Managing Rules

iptables -D INPUT 5

Delete rule number 5 from INPUT chain

iptables -D INPUT -s 10.0.0.5 -j DROP

Delete specific rule by specification

iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

Insert rule at position 1

iptables -R INPUT 1 -p tcp --dport 80 -j ACCEPT

Replace rule at position 1

iptables -F

Flush all rules in all chains

iptables -F INPUT

Flush rules in INPUT chain

iptables -X

Delete all user-defined chains

Policy Management

iptables -P INPUT DROP

Set default INPUT policy to DROP

iptables -P OUTPUT ACCEPT

Set default OUTPUT policy to ACCEPT

iptables -P FORWARD DROP

Set default FORWARD policy to DROP

iptables -P INPUT ACCEPT

Set default INPUT policy to ACCEPT

NAT & Port Forwarding

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Enable NAT masquerading

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

Redirect port 80 to 8080

iptables -t nat -A PREROUTING -p tcp -d 1.2.3.4 --dport 80 -j DNAT --to 10.0.0.5:80

Port forward to internal server

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j SNAT --to 1.2.3.4

Source NAT for subnet

Rate Limiting

iptables -A INPUT -p tcp --dport 22 -m limit --limit 5/min -j ACCEPT

Rate limit SSH connections

iptables -A INPUT -p icmp -m limit --limit 1/s -j ACCEPT

Rate limit ICMP to 1 per second

iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT

Rate limit new TCP connections

iptables -A INPUT -m hashlimit --hashlimit-above 10/min --hashlimit-mode srcip -j DROP

Limit connections per source IP

Logging

iptables -A INPUT -j LOG --log-prefix "INPUT DROP: "

Log dropped packets with prefix

iptables -A INPUT -p tcp --dport 22 -j LOG --log-level 4

Log SSH traffic with level warning

iptables -A INPUT -j LOG --log-prefix "DROPPED: " --log-level 7

Log with custom prefix and debug level

Save & Restore

iptables-save > /etc/iptables/rules.v4

Save current rules to file

iptables-restore < /etc/iptables/rules.v4

Restore rules from file

service iptables save

Save rules (RHEL/CentOS)

netfilter-persistent save

Save rules (Debian/Ubuntu)

netfilter-persistent reload

Reload saved rules

Advanced Matching

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

Block NULL packets

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

Block syn-flood attacks

iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

Block XMAS packets

iptables -A INPUT -m recent --name blacklist --set -j DROP

Add IP to recent list and drop

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

Drop invalid packets

iptables -A INPUT -p tcp -m multiport --dports 22,80,443 -j ACCEPT

Match multiple ports