Introduction to IPtables in Linux

Managing network traffic is one of the toughest jobs a system administrator has to deal with. He must configure the firewall in such a way that it will meet the system and user’s requirements for both incoming and outgoing connections, without leaving the system vulnerable to attacks and all this can be done with the help of IPtables.

 

IPtables is a Linux command line firewall that allows system administrators to manage incoming and outgoing traffic with the help of configurable table rules.

 

There are 3 types of Iptables:

 

1.  FILTER
2.  NAT
3.  MANGLE

 

• FILTER – It is the default table and it contains the following built-in chains:

 

1. INPUT
2. FORWARD
3. OUTPUT

 

• NAT – a table that is consulted when a packet tries to create a new connection. It has the following built-in chains:

 

1. PREROUTING
2. OUTPUT
3. POSTROUTING

 

• MANGLE – this table is used for packet altering. Until kernel version 2.4 this table had only two chains, but they are now 5:

 

1. PREROUTING
2. OUTPUT
3. INPUT
4. POSTROUTING
5. FORWARD

 

Mostly we play around with FILTER type of IPtables, Now, let’s see some useful commands:

 

List the currently configured IPtables rules:

 

 

Sample output:-

 

 

 

Defining Chain Rules

 

Defining a rule means appending it to the chain. To do this, you need to insert the -A option (Append) right after the iptables command, like so:

 

 

It will alert iptables that you are adding new rules to a chain. Then, you can combine the command with other options, such as:

 

• -i (interface) — the network interface whose traffic you want to filter, such as eth0, lo, ppp0, etc.
• -p (protocol) — the network protocol where your filtering process takes place. It can be either tcp, udp, udplite, icmp, sctp, icmpv6, and so on. Alternatively, you can type all to choose every protocol.
• -s (source) — the address from which traffic comes from. You can add a hostname or IP address.
• –dport (destination port) — the destination port number of a protocol, such as 22 (SSH), 443 (https), etc.
• -j (target) — the target name (ACCEPT, DROP, RETURN). You need to insert this every time you make a new rule.

 

 

1. Block Specific IP Address in IPtables Firewall

 

If you want to block all outgoing connections to a specific IP address on all the ports with the following rule, -s option used here specifies the source, the command will look like this:

 

 

2. Unblock IP Address in IPtables Firewall

 

If you want to unblock requests from specific IP address, you can delete the blocking rule with the following command:

 

 

3. Block Specific Port on IPtables Firewall

 

If you want to block incoming or outgoing connections on a specific port, below you can find such rule for both incoming and outgoing connections:

 

To block outgoing connections on a specific port use:

 

 

To allow incoming connections use:

 

 

4. Allow Multiple Ports on IPtables using Multiport

 

We can allow or block multiple ports at once, by using multiport, the blocking rule with the following commands is given below:

 

To allow incoming connections:

 

 

To block incoming connections:

 

 

5. Block any specific website on IPtables Firewall

 

First, find the IP addresses used by that website:

 

 

 

You can then block that cloudkul.com network with:

 

 

Now, when you will try to access cloudkul.com in your browser, it will not be accessible.

 

6. Block Outgoing Mails through IPTables

 

if you want to block outgoing emails, you can block outgoing ports on SMTP ports, , the command will look like this:

 

 

7. Block Incoming Ping Requests through IPtables

 

if you want to block incoming ping requests, you can use the following command if you are connected with ethO network interface, in my case I am connected with wi-fi so I replaced ethO with wlp2s0 i.e wireless network interface.

 

 

 

8. Flush IPtables Firewall Chains

 

If you want to flush your firewall chains, you can use:

 

 

 

9. Save IPtables Rules to a File

 

If you want to save your firewall rules you can use the following to save and store your rules in a file:

 

 

 

10. Restore IPtables Rules from a File

 

If you want to restore your firewall rules you can use the following to restore your rules from a file:

 

 

Iptables is a powerful firewall and important for every linux administrator to learn at least the basics of iptables. If you want to find more detailed information about iptables and its options it is highly recommended to read it’s manual:

 

 

 

                                        In case of any help or query, please contact us.