Iptables
iptables
command line utility allows to modify Linux kernel firewall rules.
Basic commands
iptables-save
andiptables-restore
apt-get install iptables-persistent
- Add:
iptables -A
- Delete:
iptables -D
Examples
KVM VNC remote viewer iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 5900 -j DNAT --to 127.0.0.1:5900 sysctl -w net.ipv4.ip_forward=1 sysctl -p /etc/sysctl.conf
- Block all output traffic:
iptables -A OUTPUT -o ethXXX -j DROP
- Open a port:
iptables -I INPUT -p tcp --dport XXX -j ACCEPT
- Block all but a range
iptables -I OUTPUT -m iprange --dst-range <remote_ip> -j ACCEPT iptables -I INPUT -m iprange --src-range <remote_ip> -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT DROP netfilter-persistent save
- Block all but one IP
iptables -I OUTPUT -d <remote_ip> -j ACCEPT iptables -I INPUT -s <remote_ip> -j ACCEPT iptables -I OUTPUT -d <remote_ip> -j ACCEPT iptables -I INPUT -s <remote_ip> -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT DROP
- Allow ssh connections only from specific IPs:
iptables -A INPUT -p tcp --dport 22 -s YourIP -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP netfilter-persistent save
Activities
- Read
iptables
Ubuntu howto: https://help.ubuntu.com/community/IptablesHowTo - Read archlinux documentation: https://wiki.archlinux.org/index.php/iptables
- Read Stackoverflow iptables questions: https://stackoverflow.com/questions/tagged/iptables?tab=Votes
- Review your current iptables configuration
iptables-save
Related terms
See also
iptables
ufw
firewalld
nftables
firewall-cmd
ipfw (FreeBSD)
PF (OpenBSD)
, netsh advfirewallnftables
- Palo Alto firewalls: PAN-OS
- Port knocking,
fail2ban
[1]fwknop
, DenyHosts
Advertising: