Linux Firewall iptables Beginner Tutorial

Iptables is an extremely flexible firewall tool built for the Linux operating system. Iptables is very useful for Linux geek players and system administrators. This article will show you how to configure the most common Linux firewall.

About Iptables

Iptables is a command-line-based firewall tool that uses a rule chain to allow/block network traffic. When a network connection tries to build on your system, Iptables looks for its corresponding matching rules. If it is not found, iptables will take the default action on it.
Almost all Linux distributions are preloaded with iptables. The commands for updating/installing iptables in Ubuntu/debian are:

sudo apt-get install iptables

Some of the existing graphical interface software can also replace iptables, such as Firestarter. But Iptables is not difficult to use. Be especially careful when configuring iptables rules, especially when you are remotely logging on to a server. Because a mistake at this point may cause you and the server to permanently lose the connection, and you have to go to the server before you can resolve it.

iptables types of rule chains

Iptables's rule chain is divided into three types: input, forward, and output.

Input-This chain is used to filter the destination address is the local connection. For example, if a user attempts to log on to your pc/server using SSH, Iptables will first match its IP address and port-to-iptables input chain rules.

Forward--This chain is used to filter the destination address and source address are not native connections. For example, the large number of data received by the router needs to be forwarded to other hosts. If your system does not have a router-like feature, such as nating, you do not need to use this chain.
There is a safe and reliable way to detect if your system needs a forwarding chain:

Iptables-l-V

is for a server that has been running for several weeks. This server does not have any restrictions on input and output. As you can see, the input and output chains have processed 11GB and 17GB of data separately, and the forwarding chain has not processed any data. This is because the server does not have a router-like forwarding feature turned on.

Output-This chain is used to filter the source address is the local connection. For example, when you try to ping howtogeek.com, iptables checks the rules in the output chain that are related to ping and howtogeek.com, and then decides whether to allow or deny your connection request.

Note: When pinging an external host, it looks as though the output chain is working. Keep in mind, however, that the data returned by the external host is filtered through the input chain. When configuring Iptables rules, keep in mind that many protocols require two-way communication, so you need to configure both the input and output chains. When you configure SSH, people often forget to configure it in both the input and output chains.

Default behavior of the chain

Before you configure specific rules, you may want to configure the default behavior for these chains. In other words, when iptables can't match the existing rules, what do you want it to do?
You can run the following command to display the current Iptables default action for a connection that cannot be matched:

Iptables-l

As shown above, we can use grep to make the results of the output more concise. In the above, all the chains accept all connections by default.
Typically, you will want your system to receive all of the network data by default. This setting is also the default configuration for iptables. The configuration commands for receiving network connections are:

Iptables--policy INPUT Accept iptables--policy OUTPUT accept iptables--policy FORWARD Accept

You can also add some commands to filter specific IP addresses or port numbers when using the default configuration. We'll cover these commands later in this article.
If you want to deny all network connections by default and then add the allowed IP address or port number on top of it, you can change the accept in the default configuration to drop, as shown in. This is extremely useful for some servers that contain sensitive data. Typically, these servers allow only specific IP addresses to access them.

Iptables--policy INPUT drop iptables--policy OUTPUT drop iptables--policy FORWARD drop

Configuration for a specific connection

Here's a look at how to set a specific IP address or port. This article mainly introduces three most basic and common settings.

accept– receives all the data.

drop– discards data. Scenario: When you don't want the source address of the data to be aware of your system's existence (the best way to handle it).

reject– does not allow the connection to be established, but returns an error response. Scenario: When you don't want an IP address to access your system, but you want them to know that your firewall is blocking its access.

To visually differentiate between the three scenarios described above, we use a single PC to ping a Linux computer configured with iptables:

Allow or block a specific connection

After you have configured the basic chain of rules, you can configure Iptables to allow or block specific IP addresses or ports.
Note: In these examples, we use IPTABLES-A to add additional rules to the existing chain. Iptables will start searching from the top of the list when performing a match. You can use Iptables-i [chain] [number] to insert a new rule into the specified position of the list.

Connections from the same IP address
The following example shows how to block all connections from an IP address of 10.10.10.10.

Iptables-a input-s 10.10.10.10-j DROP

Connections from a set of IP addresses
The following example shows how to block connections from any IP address in the subnet 10.10.10.0/24. You can use a subnet mask or a standard/symbol to indicate a subnet:

Iptables-a input-s 10.10.10.0/24-j DROP

Or

Iptables-a input-s 10.10.10.0/255.255.255.0-j DROP

Connection to a specific port
This example shows how to block an SSH connection from 10.10.10.10.

Iptables-a input-p TCP--dport ssh-s 10.10.10.10-j DROP

You can replace "ssh" with any other protocol or port number. The-p TCP in the above command tells the Iptables connection what protocol to use.

The following example shows how to block an SSH connection from any IP address.

Iptables-a input-p TCP--dport ssh-j DROP

Connection Status

As we mentioned before, many protocols require two-way communication. For example, if you intend to allow SSH connections, you must configure both the input and output chains. But what if you only want to allow SSH requests from outside?
The following example shows how to allow the source IP address to be 10.10.10.10 while blocking an SSH connection with the destination address 10.10.10.10:

Iptables-a input-p TCP--dport ssh-s 10.10.10.10-m State--state new,established-j acceptiptables-a output-p TCP-- Sport 22-d 10.10.10.10-m State--state established-j ACCEPT

Save changes

The changes made to the Iptables rules by the above method are temporary. If you want to save these changes permanently, you will need to run additional commands (the Save commands under different Linux distributions are not the same):

Ubuntu:

Sudo/sbin/iptables-save

Red Hat/centos:

/sbin/service iptables Save

Or

/etc/init.d/iptables Save

Other commands

List the current configuration of iptables:

Iptables-l

Use the-V option to display the packet and byte information, and the-N option to list the information numerically without resolving the IP address to a domain name.
In other words, the hostname, protocol, and network are listed in digital form.

Clears all current configuration rules:

Iptables-f

The original, the beginner ' s Guide to Iptables, the Linux Firewall

