iptables Firewall Commands - CodeSwordsman

iptables essentials: listing and saving rules, default policies, allowing ports and subnets, connection tracking, logging and rate limits, NAT and port forwarding, rule persistence, deleting rules by line number, with nftables notes.

iptables 1.8+ / nftables compatibilityUpdated 2026-10-3034 commands

Inspect Rules

List filter rules numerically with packet counters and line numbers for deletion

iptables -L -n -v --line-numbers

Inspect the nat table for port forwarding and address translation

iptables -t nat -L -n -v

Print rules as reusable commands, useful before backups

iptables -S

Search a chain for a specific port rule

iptables -S INPUT | grep 8080

Export all rules before changes so a rollback is possible

iptables-save > /root/iptables.bak

Show the version; RHEL 8+ uses nftables with an iptables compatibility layer

iptables -V

Newer systems accept iptables commands backed by nftables.

Policies & Chains

Risky

Set default policies; allow SSH before dropping INPUT or you lose remote access

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

Risky

Flush filter and nat rules; on production this disrupts all traffic

iptables -F
iptables -t nat -F

Create a custom chain and jump to it to group rules by service

iptables -N APP_CHAIN
iptables -A INPUT -j APP_CHAIN

Delete a custom chain after flushing it and removing jumps

iptables -X APP_CHAIN

Allow Rules

Allow loopback; many services rely on 127.0.0.1 traffic

iptables -A INPUT -i lo -j ACCEPT

Allow SSH; restrict the source subnet when working remotely

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Allow established and related connections, the basis of stateful filtering

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow only a subnet to reach the database port

iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 3306 -j ACCEPT

Allow several ports in one rule

iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT

Insert at the top to bypass earlier DROP rules in an emergency

iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

Drop & Logging

Silently drop traffic from an IP with no rejection response

iptables -A INPUT -s 203.0.113.10 -j DROP

Reject explicitly so clients fail fast instead of timing out

iptables -A INPUT -p tcp --dport 8080 -j REJECT --reject-with icmp-port-unreachable

Log attempts with a rate limit so the kernel log is not flooded

iptables -A INPUT -p tcp --dport 22 -j LOG --log-prefix "SSH-ATTEMPT: " -m limit --limit 5/min

Rate-limit new connections to ease SYN floods; tune thresholds by load testing

iptables -A INPUT -p tcp --syn -m limit --limit 20/s --limit-burst 40 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

NAT & Port Forwarding

Enable forwarding for NAT; persist it in sysctl.conf

sysctl -w net.ipv4.ip_forward=1

Source NAT for outbound traffic when the public IP is dynamic

iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j MASQUERADE

Forward local 8080 to an internal host; also allow it in FORWARD

iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.10.21:80

Allow forwarded traffic; the usual fix when DNAT works but traffic does not

iptables -A FORWARD -p tcp -d 192.168.10.21 --dport 80 -j ACCEPT

Static source NAT performs better than MASQUERADE with a fixed IP

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 203.0.113.20

Persistence

Save to the standard RHEL/CentOS path restored at boot

iptables-save > /etc/sysconfig/iptables

Back up the file first; a bad file can break networking after reboot.

Restore a full rule set from a file

iptables-restore < /etc/sysconfig/iptables

Enable boot restore with iptables-services on CentOS 7; prefer firewalld or nftables on RHEL 8+

systemctl enable --now iptables

Persist rules on Debian and Ubuntu with iptables-persistent

apt install iptables-persistent
netfilter-persistent save

Delete & Adjust

Delete by line number from --line-numbers; numbers shift afterwards

iptables -D INPUT 3

Delete by exact rule specification matching the original

iptables -D INPUT -p tcp --dport 8080 -j ACCEPT

Check whether a rule exists; exit code 0 means present, useful for idempotent scripts

iptables -C INPUT -p tcp --dport 22 -j ACCEPT; echo $?

Replace a rule in place without changing order

iptables -R INPUT 2 -p tcp -s 10.0.0.0/24 --dport 22 -j ACCEPT

Reset packet counters before measuring hits

iptables -Z