Linux Common Firewall Rules and Commands in iptables
What is firewall?
A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.
Here we are going to show you some linux common firewall rules and commands in iptables. Iptables is a useful command line utility for configuring Linux kernel firewall. Iptables contains five tables: raw, filter, nat, mangle and security. Each table consist of chains. A chain is a list of firewall rules which are followed in order. Let’s get started with some common firewall rules and commands in iptables.
Log in to your VPS via SSH as user root
ssh root@IP_Address -p Port_number
ssh [email protected] -p 22
Installing iptables is very easy. If you have an Ubuntu VPS or a Debian VPS, run the following commands:
apt-get update apt-get upgrade apt-get install iptables iptables-persistent
If there is CentOS installed on your VPS, run the following commands:
yum clean all yum update yum install iptables
That’s it, now you should have successfully installed iptables on your server.
Now, Lets see the common firewall rules in iptables
Listed below are examples about common firewall rules.
Accept all ESTABLISHED and RELATED packets:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Allow HTTP and HTTPS connections from anywhere:
iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Allow access on port 21 from a specific IP address only (e.g. 192.168.1.111) and block access from all other IPs to the server (e.g. server IP 192.168.1.100) :
iptables -A INPUT -s 192.168.1.111 -d 192.168.1.100 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT iptables -A INPUT -d 192.168.1.100 -p tcp -m tcp --dport 21 -j DROP iptables-save
Block an IP address (e.g. 192.168.1.19):
iptables -A INPUT -s 192.168.1.19 -j DROP
Block an IP range and reject all packets (e.g. 192.168.1.0/24):
iptables -A INPUT -s 192.168.1.0/24 -j REJECT
To block outgoing traffic to a port, (e.g. port 123), use:
iptables -A OUTPUT -p tcp --dport 123 -j DROP
Common iptables commands
List all rules in all chains in verbose mode and display the IP addresses and port numbers instead host names and services, including the interface name, the rule options (if any), and the TOS masks:
iptables -nvL | less
Chain INPUT (policy ACCEPT 17M packets, 3161M bytes)
pkts bytes target prot opt in out source destination
90M 18G cP-Firewall-1-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 cP-Firewall-1-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 16M packets, 5107M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587 owner GID match 32006
18618 9100K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587 owner GID match 12
0 0 ACCEPT tcp -- * * 0.0.0.0/0 127.0.0.1 multiport dports 25,465,587 owner UID match 32001
10686 946K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587 owner UID match 0
Chain cP-Firewall-1-INPUT (2 references)
pkts bytes target prot opt in out source destination
39 2264 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:993
54 2872 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:53
7509 450K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
557K 34M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443
19655 1142K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
1057 43388 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:8080
7533 452K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:143
382 16664 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
2871K 173M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:995
23539 1284K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110
8353 500K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25
71 3680 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:465
519K 31M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306
132 9948 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
To display rules in chains with rule numbers, use:
iptables -nvL --line-numbers
This is useful if you want to delete a rule (e.g. delete rule number 9 from the INPUT chain):
iptables -D INPUT 9
Or, add a rule between two existing rules (e.g. add a firewall rule between rules number 2 and 3):
iptables -I OUTPUT 3 -d 127.0.0.1/32 -p tcp -m multiport --dports 25,465,587 -m owner --uid-owner 201 -j ACCEPT
In order to list all commands that were used to create the currently used iptables rules, use the following command:
iptables -S
This command is useful if you need to edit or delete some firewall rules.
-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N cP-Firewall-1-INPUT -A INPUT -j cP-Firewall-1-INPUT -A FORWARD -j cP-Firewall-1-INPUT -A OUTPUT -p tcp -m multiport --dports 25,465,587 -m owner --gid-owner mailman -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 25,465,587 -m owner --gid-owner mail -j ACCEPT -A OUTPUT -d 127.0.0.1/32 -p tcp -m multiport --dports 25,465,587 -m owner --uid-owner cpanel -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 25,465,587 -m owner --uid-owner root -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT -A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT -A cP-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
Clear all firewall rules:
iptables -F
Use ‘iptables -h | less’ for more information on all iptables command options.
Hope this article helps you, please share your valuable comments to improve us.
To setup the Firewall on Dedicated Linux Server click here.
