Linux Security: The Complete Iptables Firewall Guide

Explore Linux firewalls with netfilter and iptables, learning packet filtering, network address translation, port forwarding, and kernel-space versus user-space roles.

Apply iptables firewall concepts within Linux Netfilter, exploring chains, tables, rules, and targets. Understand how input, output, and forward chains filter packets, with default policies and stateful inspection.

Explore how iptables uses netfilter tables to filter packets, focusing on the default filter table with the input chain and port 22 rules, and outline nat, mangle, and route tables.

Master how a packet traverses netfilter tables and chains in iptables, from input, output, and forward in the filter table, to nat and mangle rules, prerouting and postrouting.

master iptables options and flags to add or insert rules in the input chain, using -A, -I, -p, --dport, and -j drop or accept, and understand why rule order matters.

Explore iptables options and flags such as -L, -F, -Z, -N, -v, -n, -x, and -P to list, flush, reset counters, create chains, set default policies, and delete rules.

Write iptables rules in a script, make it executable, and run at boot to persist them. Use flush with iptables -F and NAT rules in -t nat POSTROUTING.

Explore the difference between iptables append (-A) and insert (-I) rules, and how order affects ssh traffic when scripting a deny-all, permit-one pattern in the input chain on port 22.

List iptables by tables and chains to view rules, default policy, and traffic counters; use -L with -n and -v, and -t to inspect other tables mangle or raw.

Learn how iptables processes traffic through input, output, and forward chains with rules that accept or drop when matched, and how the default policy shapes secure firewall behavior.

Learn how to reset a Linux iptables firewall to an open state by flushing all rules, deleting user-defined chains, and setting accept policies on all chains.

Save iptables rules from memory to a file and load them at boot with iptables-save and iptables-restore. On Debian/Ubuntu, use iptables-persistent to auto-load rules from /etc/iptables/rules.v4 and rules.v6.

Master iptables filtering by source or destination IP and networks using input and output chains, with -s, -d, and -j drop, including domain name handling and the 0/0 wildcard.

Learn to filter by ip range in iptables with the iprange match, replacing many rules with a single rule and using addr type for unicast, multicast, and broadcast.

Learn to filter traffic by tcp or udp ports using iptables, with -p, -dport, -sport, and -m multiport, and differentiate open, filtered, and closed ports.

Match transport-layer protocols with iptables using -p for tcp, udp, and non-port-based protocols like icmp. Implement a default drop policy and allow loopback and tcp/udp traffic.

Match packets by the interface they arrive on or leave through using -i and -o options, in input, forward, pre-routing, and post-routing chains, and permit loopback traffic on lo.

Learn how to negate matches in iptables using the exclamation mark to allow https traffic only from a specific ip, dropping all others, with practical telnet tests.

Block incoming ssh connections on port 22 by matching the syn flag with iptables using --tcp-flags and --syn to drop unauthorized packets. Allow ssh only from a specific ip.

Discover how stateful firewalls use connection tracking to maintain per-connection state in memory, distinguishing new, established, related, invalid, and untracked packets to control traffic.

Implement a stateful iptables firewall on a desktop, flush rules, drop invalid packets, allow loopback, and permit outgoing while accepting only established or related incoming ssh traffic.

Filter packets by source mac address with iptables using -m mac --mac-source, dropping or permitting traffic on the input or forward chain for devices in a network, noting mac spoofing.

Filter traffic by date and time with iptables minus m time options, noting UTC versus system time; enable ssh 10:00–16:00 on weekdays and allow ubuntu.com after hours using forward chain.

Master the netfilter con limit module to cap parallel connections per client IP on ports like 25 and 80, and compare reject versus drop targets with TCP resets.

Master the iptables limit match, a token bucket based rate limiter that restricts matches per unit time. Use --limit and --limit-burst to control bursts and rate, with icmp and tcp.

Learn to build a dynamic blacklist with iptables recent module, ban port 25 attackers between 8 and 10 p.m. UTC, and enforce a 60-second quiet time with a hackers list.

Explore how quota matches in iptables cap traffic by limiting bytes or packets. Apply rules to permit a set amount of traffic and drop excess, with per-ip and time-based options.

Discover how ipset extends iptables to match large sets of addresses with a single rule, boosting performance and simplifying firewall administration, including installation on Debian/Ubuntu by apt install ipset.

Learn how Ipset creates named address sets to efficiently match source IPs in iptables rules, enabling a single rule to block many addresses and test connectivity with 8.8.8.8.

Master ipset basics in the iptables context by creating named sets, using hash:net or hash:ip types, adding and deleting entries, and applying exist, flush, and destroy options, plus max elements.

Block bad hosts automatically by using iptables with ipset to dynamically add source IPs to an auto blocked set on port 80 and drop future packets.

Learn to clear the running firewall by flushing iptables and ipset, deleting user-defined chains, and resetting to an open state with a stop firewall script.

Block malicious traffic on a Linux server by using ipset with iptables: read IPs from a file, create an IP hash set, and drop those packets.

Block traffic from china by creating an ipset named china and applying a single iptables rule, loading cn-aggregated.zone via wget and dropping packets by source ip.

Explore iptables targets, distinguishing terminating targets like accept and drop from non-terminating targets like log, and see how each affects packet evaluation in a firewall.

Use iptables accept and drop targets to permit icmp echo requests from the management station (192.168.0.112) and drop all others on the input chain.

Identify tcp and udp port states—open, closed, and filtered—and learn how firewalls, netstat, and port scanning reveal services and influence security practices.

Master netstat basics to view listening ports and active connections on Linux, Windows, and Mac. Use -t, -u, -p, -a, -n and grep to filter for ports like 22.

Learn how Nmap enables network discovery and security auditing with TCP SYN and connect scans, port state detection, service version discovery, and UDP and ICMP scans.

Explore the iptables reject target, which sends an icmp port unreachable by default and can use --reject-with for tcp reset, contrasting it with drop that silently drops packets.

Learn how the iptables log target records packet headers via the kernel logging facility and lets packets continue through the chain, and view logs with grep from /var/log/kern.log.

Learn how to mirror traffic with iptables tee target by cloning and redirecting packets to a second Linux host on a local subnet, demonstrated with icmp echo requests and tcpdump.

Learn how the redirect target forwards traffic from ports one through four to port 22 in the pre routing chain, enabling transparent proxy setups and on-machine filtering.