Iptables is a robust firewall software that comes standard with many Linux variants. It enables system administrators to manage network traffic by setting rules and policies to restrict incoming and outgoing connections.
In this article lead you through the installation and configuration of iptables on your Linux system.
Prerequisites
- SSH root or sudo access to your Linux system.
What are Iptables?
Iptables is a firewall application created exclusively for Linux. It works by using tables to monitor the traffic traveling to and from your server. These tables are made up of chains of rules that efficiently filter and manage incoming and outgoing data packets.
Process of Iptables
The most commonly used table is the filter table, which has three chains:
When a packet matches a rule, it is allocated a target. The target can be:
How to Install Iptables on Linux Firewall?
If Iptables is not Installed by default on your Ubuntu/Debian system, you can install iptables it by following these steps:
Update and Installation command
SSH into your server using your favorite SSH client.
After you’ve established the SSH connection, run the following instructions in order:
sudo apt-get update sudo apt-get install iptables
Run the following command to see the status of your existing iptables configuration:
sudo iptables -L -v
- The -L option displays a list of all the rules in iptables.
- The -v option generates more detailed output, displaying more specific information about the rules.
When you run sudo iptables -L -v, the rules will be shown in the following format:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Add a New Chain Rules
To define a rule in iptables and add it to a chain, use the -A (Append) option immediately after the iptables command. The updated command structure is as follows:
sudo iptables -A
The -A option instructs iptables to add a new rule to the chain supplied. Other parameters define the rule’s specifics, such as the interface, protocol, source address, destination port, and target.
Enable Traffic on localhost
To allow traffic on localhost, run the following command:
sudo iptables -A INPUT -i lo -j ACCEPT
The lo interface is the loopback interface, which is used for all localhost connections.
The command -A INPUT -i lo -j ACCEPT instructs iptables to add a rule to the INPUT chain that permits all incoming traffic on the lo interface.
This ensures that the connections between a database and a web application running on the same computer remain functional.
Port Connections for HTTP, SSH, and SSL
The -p option specifies the protocol, and the -dport option provides the destination port. All inbound TCP traffic on ports 22, 80, and 443 would be allowed using the following commands:
sudo iptables -A INPUT -p tcp -dport 22 -j ACCEPT sudo iptables -A INPUT -p tcp -dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp -dport 443 -j ACCEPT
Once you have added these rules, you can use the iptables -L command to get a list of all the rules in the INPUT chain. This will assist you in ensuring that the rules were successfully added.
sudo iptables -L -v cloudbooklet@ubuntu:~$ sudo iptables -L -v Chain INPUT (policy ACCEPT 600 packets, 98837 bytes) pkts bytes target prot opt in out source destination 16 2008 ACCEPT all – lo any anywhere anywhere 34 2668 ACCEPT tcp – any any anywhere anywhere tcp dpt:ssh 0 0 ACCEPT tcp – any any anywhere anywhere tcp dpt:http 0 0 ACCEPT tcp – any any anywhere anywhere tcp dpt:https Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 577 packets, 75262 bytes) pkts bytes target prot opt in out source destination cloudbooklet@ubuntu:~$
The following results show that all TCP protocol connections from the specified ports will be accepted if the command is executed Successfully.
Source Based Packet Filtering
To use iptables to filter packets based on an IP address or a range of IP addresses, run the following commands:
Accepting packets from a certain IP address:
sudo iptables -A INPUT -s 192.168.1.3 -j ACCEPT
To reject packets from a certain IP address, use the following syntax:
sudo iptables -A INPUT -s 192.168.1.3 -j DROP
To use the iprange module to discard packets from a range of IP addresses, use the -m option and provide the IP address range with -src-range. To divide the range, make sure there is no space between them and use a hyphen:
sudo iptables -A INPUT -m iprange -src-range 192.168.1.100-192.168.1.200 -j DROP
Drop Target for Other Traffic
To drop all other traffic and prevent unauthorized connections from accessing the server via other open ports, use the following command:
sudo iptables -A INPUT -j DROP
By applying this rule, any connection outside of the specified ports will be dropped, resulting in improved server security.
Remove Iptables Rules
To remove a specific rule from iptables, perform the following steps:
If you want to delete all rules and start over, use the -F option (flush):
sudo iptables -F
List the rules that are available, together with their line numbers:
sudo iptables -L -line-numbers
You will see a list of rules, each with a number attached to it.
Determine the rule to be deleted by its chain and line number.
Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all – 192.168.0.4 anywhere 2 ACCEPT tcp – anywhere anywhere tcp dpt:https 3 ACCEPT tcp – anywhere anywhere tcp dpt:http 4 ACCEPT tcp – anywhere anywhere tcp dpt:ssh
For instance, suppose you want to remove rule 3 from the INPUT chain:
sudo iptables -D INPUT 3
This command will remove the specified rule from iptables, allowing you to more efficiently manage your firewall settings.
Iptables Persistent Package Change
The following commands can be used to store the iptables rules to a file and make them persistent after a reboot:
#For IPv4 rules: sudo iptables-save > /etc/iptables/rules.v4 #For IPv6 rules: sudo iptables-save > /etc/iptables/rules.v6
Use the following commands to reload the saved rules after a reboot:
#For IPv4 rules: sudo iptables-restore < /etc/iptables/rules.v4 #For IPv6 rules: sudo iptables-restore < /etc/iptables/rules.v6
Install the iptables-persistent package to enable automatic rule loading:
sudo apt-get install iptables-persistent
During the installation, you will be asked to store the current IPv4 and IPv6 rules. Choose “Yes” to save the rules.
Please keep in mind that even with iptables-persistent, you must manually save the rules with sudo iptables-save every time you make changes to iptables.
Also read: You might also find useful our guide on How to Open Port in Linux: Simple Step-by-Step Guide
Conclusion
To summarize, install iptables on your Linux system is a simple operation if you follow the instructions given in this article, you can rapidly set up and configure iptables to manage network traffic, improve security, and control incoming and outgoing connections.
Please feel free to share your thoughts and feedback in the comment section below.
How to Install Iptables on Linux