iptables on Linux: Practical Firewall Setup

iptables is the default Linux kernel firewall. Found in virtually all distributions, it inspects and filters every network packet that enters, exits, or passes through the system. Understanding iptables is essential for securing production servers, configuring networks, and passing certifications like LPIC-2 and CompTIA Linux+.

In this guide you will learn the syntax, main rules, and most common use cases — with ready-to-use examples.

How iptables works: tables and chains

iptables organizes rules into tables, each with a different purpose:

Table	Use
filter	Packet filtering (default — used in most rules)
nat	Address translation (NAT, masquerade, port forwarding)
mangle	Packet header modification (QoS, TTL)
raw	Connection tracking control (conntrack)

Each table has chains that determine when rules are evaluated:

Chain	When it's evaluated
INPUT	Packets destined to the server itself
OUTPUT	Packets generated by the server itself
FORWARD	Packets passing through the server (routing)
PREROUTING	Before routing (nat/mangle)
POSTROUTING	After routing (nat/mangle)

Basic iptables commands

# Listar regras com detalhes (números de linha, contadores)
iptables -L -n -v --line-numbers

# Listar regras de uma tabela específica
iptables -t nat -L -n -v

# Adicionar regra no final da chain (-A = append)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Inserir regra em posição específica (-I = insert)
iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

# Deletar regra pelo número da linha
iptables -D INPUT 3

# Deletar regra pela especificação
iptables -D INPUT -p tcp --dport 80 -j ACCEPT

# Limpar todas as regras de uma chain (-F = flush)
iptables -F INPUT

# Limpar todas as regras de todas as chains
iptables -F

# Definir política padrão de uma chain
iptables -P INPUT DROP

Most common targets

Target	Behavior
ACCEPT	Accepts the packet
DROP	Silently drops (no response)
REJECT	Drops and sends error message to sender
LOG	Logs the packet to syslog and continues
RETURN	Returns to the calling chain
MASQUERADE	Dynamic NAT (nat table)
DNAT	Redirects to another IP/port (nat table)

Practical examples

1. Basic server configuration: DROP policy + exceptions

The safest approach: blocks everything by default and only allows what's necessary.

# Salva as regras atuais antes de começar
iptables-save > /tmp/iptables_backup.rules

# Define política padrão: DROP em INPUT e FORWARD, ACCEPT em OUTPUT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Permite tráfego loopback (necessário para o sistema funcionar)
iptables -A INPUT -i lo -j ACCEPT

# Permite conexões já estabelecidas e relacionadas
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Libera SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Libera HTTP e HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

2. Allow port for specific IP only

# Permite SSH apenas do escritório (192.168.1.100)
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

# Libera acesso ao banco de dados apenas do servidor de aplicação
iptables -A INPUT -p tcp --dport 3306 -s 10.0.1.50 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

3. Block IP or IP range

# Bloquear IP específico
iptables -A INPUT -s 203.0.113.99 -j DROP

# Bloquear faixa de IPs (CIDR)
iptables -A INPUT -s 203.0.113.0/24 -j DROP

# Bloquear e registrar tentativas antes de dropar
iptables -A INPUT -s 203.0.113.0/24 -j LOG --log-prefix "BLOCKED: "
iptables -A INPUT -s 203.0.113.0/24 -j DROP

4. Protect against common attacks

# Bloquear pacotes inválidos
iptables -A INPUT -m state --state INVALID -j DROP

# Limitar tentativas de conexão SSH (anti-brute force)
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --set --name SSH_BRUTE
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --update --seconds 60 --hitcount 4 --name SSH_BRUTE -j DROP

# Limitar ping (ICMP) para evitar flood
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

# Bloquear pacotes SYN suspeitos (SYN flood)
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

5. NAT and internet sharing (Masquerade)

So that machines on the internal network access the internet through the Linux server:

# Habilitar IP forwarding no kernel
echo 1 > /proc/sys/net/ipv4/ip_forward
# Para tornar permanente, adicione no /etc/sysctl.conf:
# net.ipv4.ip_forward = 1

# Masquerade: toda saída pela interface eth0 usa o IP do servidor
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Permite o tráfego entre as interfaces
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

6. Port forwarding

# Redirecionar porta 80 pública para porta 8080 interna
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# Redirecionar para outro servidor interno
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT

7. Log packets for debugging

# Registrar e depois aceitar
iptables -A INPUT -p tcp --dport 22 -j LOG --log-prefix "SSH-ENTRADA: " --log-level 4
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Ver logs em tempo real
tail -f /var/log/syslog | grep "SSH-ENTRADA"
# ou
journalctl -f | grep "SSH-ENTRADA"

Save and restore rules

iptables rules are lost on reboot. To make them persistent:

# Salvar regras atuais
iptables-save > /etc/iptables/rules.v4    # Debian/Ubuntu
iptables-save > /etc/sysconfig/iptables   # CentOS/RHEL

# Restaurar manualmente
iptables-restore < /etc/iptables/rules.v4

# No Ubuntu/Debian: instalar o pacote que restaura automaticamente no boot
apt install iptables-persistent
netfilter-persistent save

# No CentOS/RHEL: usar o serviço
systemctl enable iptables
systemctl start iptables

Check rules and diagnostics

# Listar tudo com contadores (quantos pacotes cada regra processou)
iptables -L -v -n

# Listar com números de linha (útil para deletar por posição)
iptables -L INPUT --line-numbers

# Zerar contadores sem apagar regras
iptables -Z

# Ver regras da tabela NAT
iptables -t nat -L -n -v

iptables vs nftables

nftables is the modern replacement for iptables, available since kernel 3.13. In newer distros (Debian 10+, Ubuntu 20.04+, RHEL 8+) it is already the default underneath, with the iptables command being a wrapper over nftables.

# Ver se você está usando iptables-legacy ou nftables
iptables --version
# iptables v1.8.7 (nf_tables) ← já usa nftables por baixo
# iptables v1.8.2 (legacy)    ← iptables clássico

# Equivalente nftables de uma regra iptables:
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
nft add rule inet filter input tcp dport 22 accept

For LPIC-2 certification purposes, the content covered is still classic iptables. For new installations, consider learning nftables.

Quick reference

# Ver regras
iptables -L -n -v --line-numbers

# Regra básica de servidor seguro
iptables -P INPUT DROP && iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Anti-brute force SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

# NAT simples
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Salvar (Debian/Ubuntu)
iptables-save > /etc/iptables/rules.v4