Iptables for beginners

Iptables is highly versatile and accepts direct commands from the user who can load and unload rules according to the need.

This tutorial shows how to protect a web server, forward connections to internal IP addresses from our LAN, and offer specific services to whitelisted IP addresses only.

Note: This Iptables tutorial was first released two years ago and updated on 23/05/2021 with improved examples and better quality screenshots.

How to install

Iptables are omitted by default in distributions that incorporate Nftables.

To install Iptables on Debian based Linux distributions, run the following command:

Opening HTTP and HTTPS ports

First of all, let’s add all ACCEPT policies starting with the webserver.

Note: If you create a script with rules, you don’t need to use sudo.

To see added rules run “iptables -L”

Where:

Iptables = calls the program

-A = adds a rule

INPUT = incoming traffic

-p = protocol

–ddport = destination port

-j = specify the “target”; the target is the type of policy: ACCEPT, DROP, REJECT (Built-in)…

Iptables -L = lists all iptables loaded rules (Iptables -L -v = the same with verbosity.)

In the example above, we instruct Iptables to add a rule for incoming traffic through TCP protocol and ports 80 (http) and 443 (https) to be accepted.

We can change the command to accept the connection only from a specific IP by adding the parameter “-s”:

Where:

s = source

You can also test your firewall with nmap:

Note: In the example above, port 443 isn’t shown because the server has not an SSL certificate adequately configured.

Note: For more information on Nmap, you can read this.

Protecting your server with Iptables:

Where the new parameters are:

-m means “match” and is used to call Iptables extensions like conntrack, which is not part of iptables core functions.

conntrack = Allows tracking information on connections like specific addresses or, in this case, the state of the connection. This must be used carefully since many rules to defend servers from some attacks use conntrack while the hardware limits its use, and such limitation can be used to overload the server’s resources.

-ctstate = determines the state of the rule to match; the possible states are: NEW, ESTABLISHED, RELATED and INVALID.

Where:

In the first liNe, our rule says “-m conntrack –ctstate NEW,” which means if the connection is new, then pass to the rule “22-test”.

The second line says packets netmask 255.255.255.255 are named as CONNECTIONS.

The third line says if a CONNECTIONS is over 3 times within 30 seconds, the firewall continues applying the chain 22-protection. The fourth line says if the CONNECTIONS weren’t seen over 3 times within 30 seconds, they could be accepted.

The fifth line, which belongs to the 22-protection chain, says to drop CONNECTIONS if they seem to be over 3 times within 30 seconds.

Now to end, let’s refuse all unawolled incoming connections and let’s allow all outgoing traffic:

P refers to the chain policy; remember the target is the policy, ACCEPT, DROP, REJECT. In this case, we are saying the default policy for outgoing traffic is to accept, and the default policy for incoming traffic is to refuse unless we specified something different in previous rules. This is a very basic firewall that does not include rules for many attacks, for learning purposes and not for production; at the end of the article, I attach a firewall I used for production on a server; it has comments explaining each rule.

FORWARDING A CONNECTION TO A SPECIFIC PORT TO A SPECIFIC IP ADDRESS

This is also very useful for desktop users who want to enroute a connection through a specific device; it can be useful even for gamers; usually, we do it from the router settings but let’s assume the routing device is running Iptables.

The rules above invoke NAT (Network Address Translation) to specify connections through protocol TCP to the address X.X.X.X, and port 8080 will be redirected to address Y.Y.Y.Y, port 80. The second rule specifies replies must be sent to the source address (X.X.X.X). We can use these rules to allow access to an IP camera, enable online gaming with external networks, etc.

This tutorial was meant to introduce beginners to Iptables and only explains a limited number of basics. Below you can see a sample of a well-planned firewall used for a production server; it includes some of the rules we already saw to more complex rules to prevent DDoS, among other types of attacks.

Bonus: Sample of production firewall