LFCE 73 🐧 iptables — Fundamentals - KandZ

⏱️ Estimated read: 13 min | |

iptables is the traditional Linux packet-filtering framework. It is built on the Netfilter kernel subsystem, and it provides a set of tables, chains, and rules that determine whether a packet is accepted, dropped, rejected, or modified. The previous chapters covered services that listen on the network—web servers, mail servers, file-sharing servers, and time servers. This chapter covers the firewall that controls who can reach those services. The LFCE exam objectives include implementing packet filtering, and iptables is the tool that the exam expects the candidate to know .

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The firewall is organized into tables, each of which corresponds to a different kind of decision. The filter table is the default and contains the rules that accept or drop packets. The nat table contains the rules that modify addresses and ports. The mangle table contains the rules that modify packet headers. The raw table is used for connection tracking exemptions. Within each table, the rules are organized into chains: INPUT for packets destined for the local host, OUTPUT for packets originated by the local host, FORWARD for packets passing through the host, PREROUTING for packets that arrive before a routing decision, and POSTROUTING for packets that leave after a routing decision .

Key point: iptables processes the rules in a chain in order, and the first rule that matches determines the packet’s fate. The default policy of a chain—ACCEPT or DROP—applies when no rule matches. A firewall that sets the default policy to DROP and does not add a rule for a required service blocks that service. The -A flag appends a rule to the end of a chain, the -I flag inserts a rule at the beginning, and the -D flag deletes a rule. The rules are not persistent across reboots unless they are saved and restored.

Why iptables requires understanding the table and chain model

The table-selection problem.

A rule that accepts or drops a packet belongs in the filter table. A rule that translates an address belongs in the nat table. A rule that modifies a header field belongs in the mangle table. A rule placed in the wrong table has no effect on the intended traffic, because each table is consulted at a different point in the packet’s journey. The iptables -t nat -L command lists the rules in the nat table, and the iptables -L command lists the rules in the filter table . The -t flag selects the table, and the default is filter.

The chain-traversal problem.

A packet that arrives at the host is processed by the PREROUTING chain, then routed, and then processed by the INPUT chain if it is destined for the local host, or by the FORWARD chain if it is passing through. A packet that is originated by the local host is processed by the OUTPUT chain and then by the POSTROUTING chain. The order matters, and a rule in the FORWARD chain does not affect a packet that is destined for the local host . The FORWARD chain is only used when the host is acting as a router and ip_forward is enabled.

The default-policy problem.

The default policy of a chain is the action taken when no rule matches. The two common policies are ACCEPT and DROP. A policy of ACCEPT allows all traffic that is not explicitly denied, which is convenient but insecure. A policy of DROP denies all traffic that is not explicitly allowed, which is secure but requires every required service to be allowed explicitly. A firewall that sets the INPUT policy to DROP and forgets to allow SSH locks the administrator out of the server.

a. The tables and chains

The filter table is the default and contains the INPUT, OUTPUT, and FORWARD chains. The nat table contains the PREROUTING, POSTROUTING, and OUTPUT chains. The mangle table contains all five chains and is used for header modification.

# List the filter table rules
sudo iptables -L -n -v

# List the nat table rules
sudo iptables -t nat -L -n -v

# List the mangle table rules
sudo iptables -t mangle -L -n -v

The -L flag lists the rules, the -n flag shows numeric addresses and ports instead of resolving them to names, and the -v flag shows the packet and byte counters for each rule . The counters are useful for confirming that a rule is matching traffic.

The chains are the paths that packets follow. The INPUT chain processes packets that are destined for the local host. The FORWARD chain processes packets that are passing through the host. The OUTPUT chain processes packets that the host originates.

# List the rules in a specific chain
sudo iptables -L INPUT -n -v
sudo iptables -L FORWARD -n -v
sudo iptables -L OUTPUT -n -v

The -L INPUT form lists only the rules in the INPUT chain, which is useful when the full listing is too long.

b. Adding, inserting, and deleting rules

The -A flag appends a rule to the end of a chain, the -I flag inserts a rule at the beginning (or at a specified position), and the -D flag deletes a rule. The rule specification includes the match criteria and the target.

# Allow SSH from a specific network
sudo iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# Allow HTTP and HTTPS from anywhere
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop all other incoming traffic
sudo iptables -A INPUT -j DROP

The -p tcp specifies the protocol, the --dport 22 specifies the destination port, and the -s 192.168.1.0/24 specifies the source network. The -j ACCEPT target accepts the packet, and the -j DROP target silently discards it . The order matters: the specific rules must appear before the general DROP, or the DROP rule catches the packet first.

The -I flag inserts a rule at the top of the chain, which is useful when a rule must be evaluated before the existing rules.

# Insert a rule at the top of the INPUT chain
sudo iptables -I INPUT 1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

The -I INPUT 1 inserts the rule at position 1, which is the beginning of the chain. The rule is evaluated before any rule that was previously at the top.

The -D flag deletes a rule by its specification or by its position number.

# Delete by specification
sudo iptables -D INPUT -p tcp --dport 80 -j ACCEPT

# Delete by position number
sudo iptables -D INPUT 1

The -D INPUT 1 deletes the first rule in the INPUT chain. The position number is shown by the --line-numbers option to the -L command.

# List rules with line numbers
sudo iptables -L INPUT -n --line-numbers

The line numbers make it easy to delete a specific rule by its position .

c. The default policy and rule persistence

The default policy of a chain is set with the -P flag. The two common policies are ACCEPT and DROP. A secure firewall sets the INPUT and FORWARD policies to DROP and the OUTPUT policy to ACCEPT.

# Set the default policies
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

The INPUT DROP policy denies all incoming traffic that is not explicitly allowed. The FORWARD DROP policy denies all forwarded traffic. The OUTPUT ACCEPT policy allows all outgoing traffic, which is the common configuration for a server that needs to reach the network.

The rules are not persistent across reboots. The iptables-save and iptables-restore commands save and restore the rules.

# Save the rules to a file
sudo iptables-save > /etc/iptables/rules.v4

# Restore the rules from a file
sudo iptables-restore < /etc/iptables/rules.v4

The iptables-save command writes the current rules to stdout, and the redirect writes them to a file. The iptables-restore command reads the file and applies the rules. On Debian and Ubuntu, the iptables-persistent package restores the rules at boot from /etc/iptables/rules.v4. On RHEL, the iptables-services package provides the iptables service that does the same . The netfilter-persistent save command is the Debian-specific wrapper that calls iptables-save and writes the file.

Complete Example Session

# ============================================
# PART 1: LIST THE CURRENT RULES
# ============================================
sudo iptables -L -n -v
# Output shows the current rules and the default policies

# ============================================
# PART 2: SET THE DEFAULT POLICIES
# ============================================
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# ============================================
# PART 3: ALLOW LOOPBACK
# ============================================
sudo iptables -A INPUT -i lo -j ACCEPT

# ============================================
# PART 4: ALLOW ESTABLISHED CONNECTIONS
# ============================================
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# ============================================
# PART 5: ALLOW SSH FROM THE LOCAL NETWORK
# ============================================
sudo iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# ============================================
# PART 6: ALLOW HTTP AND HTTPS
# ============================================
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# ============================================
# PART 7: DROP ALL OTHER INCOMING TRAFFIC
# ============================================
sudo iptables -A INPUT -j DROP

# ============================================
# PART 8: VERIFY THE RULES
# ============================================
sudo iptables -L INPUT -n -v --line-numbers
# Output shows the rules in order with line numbers

# ============================================
# PART 9: TEST THE FIREWALL
# ============================================
curl -I http://localhost
# The local connection succeeds because of the loopback rule
# A remote SSH connection from the allowed network succeeds
# A connection from an unallowed network is dropped

# ============================================
# PART 10: SAVE THE RULES
# ============================================
sudo iptables-save > /etc/iptables/rules.v4
# Or: sudo netfilter-persistent save

The ten parts demonstrate the complete iptables setup: listing, setting the default policies, allowing loopback, allowing established connections, allowing SSH from the local network, allowing HTTP and HTTPS, dropping the rest, verifying, testing, and saving. The critical rules are Parts 3 and 4: the loopback rule and the established-connection rule are the ones that keep the basic services working after the default policy is set to DROP.

Quick Reference

Tables

Table	Purpose
`filter`	Accept, drop, or reject packets (default)
`nat`	Address and port translation
`mangle`	Header modification
`raw`	Connection-tracking exemptions

Chains

Chain	Packets
`INPUT`	Destined for the local host
`OUTPUT`	Originated by the local host
`FORWARD`	Passing through the host
`PREROUTING`	Before routing (nat, mangle)
`POSTROUTING`	After routing (nat, mangle)

Commands

Command	Purpose
`iptables -L -n -v`	List rules
`iptables -A CHAIN ...`	Append a rule
`iptables -I CHAIN N ...`	Insert at position N
`iptables -D CHAIN N`	Delete rule N
`iptables -P CHAIN TARGET`	Set the default policy
`iptables-save > file`	Save rules
`iptables-restore < file`	Restore rules

Common Targets

Target	Action
`ACCEPT`	Allow the packet
`DROP`	Silently discard
`REJECT`	Discard with an error response
`LOG`	Log the packet and continue

Match Options

Option	Purpose
`-p tcp`	Protocol
`--dport 22`	Destination port
`-s 192.168.1.0/24`	Source network
`-i eth0`	Incoming interface
`-m conntrack --ctstate ESTABLISHED,RELATED`	Connection state

Best Practices

✅ Do This:

# Set default policies before adding rules
iptables -P INPUT DROP                                         # ✅

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT                              # ✅

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # ✅

# Allow specific services before the DROP rule
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT # ✅

# Save the rules
iptables-save > /etc/iptables/rules.v4                         # ✅

# Use line numbers for deletion
iptables -L INPUT -n --line-numbers                            # ✅

❌ Don’t Do This:

# Set the default policy to DROP without allowing SSH
iptables -P INPUT DROP    # Locks out remote access            # ❌

# Forget the loopback rule
# Local services cannot reach each other                        # ❌

# Forget the established-connection rule
# Replies to outgoing connections are dropped                  # ❌

# Add a DROP rule before the specific allows
iptables -A INPUT -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT    # Never reached # ❌

# Forget to save the rules
# The firewall is lost on reboot                               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Locked out of SSH	Default `DROP` without an SSH allow rule	Add the rule before setting the policy
Local services fail	Loopback not allowed	`iptables -A INPUT -i lo -j ACCEPT`
Replies dropped	Established-connection rule missing	Add the conntrack rule
Rules not persistent	Not saved	`iptables-save` or `netfilter-persistent save`
Rule has no effect	Wrong table or chain	Check `-t` and the chain name
Cannot delete a rule	Wrong position number	`--line-numbers` to find the position

Real-World Examples

1. List rules

iptables -L -n -v

2. Set policy

iptables -P INPUT DROP

3. Allow loopback

iptables -A INPUT -i lo -j ACCEPT

4. Allow established

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

5. Allow SSH

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

6. Allow HTTP

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

7. Drop the rest

iptables -A INPUT -j DROP

8. Insert at the top

iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

9. Delete a rule

iptables -D INPUT 1

10. Save rules

iptables-save > /etc/iptables/rules.v4

Visual

Table and Chain Traversal

┌──────────────────────────────────────────────────────────────┐
│  A PACKET TRAVERSES THE CHAINS IN A FIXED ORDER              │
│                                                              │
│  Incoming packet                                             │
│       │                                                      │
│       ▼                                                      │
│  PREROUTING (raw, mangle, nat)                               │
│       │                                                      │
│       ▼                                                      │
│  Routing decision                                            │
│       │                                                      │
│       ├── Destined for local host → INPUT (filter)           │
│       │                                                      │
│       └── Passing through → FORWARD (filter)                 │
│                                                              │
│  Locally generated packet                                    │
│       │                                                      │
│       ▼                                                      │
│  OUTPUT (raw, mangle, nat, filter)                           │
│       │                                                      │
│       ▼                                                      │
│  POSTROUTING (mangle, nat)                                   │
│                                                              │
│  Each table is consulted at its own point in the journey.    │
└──────────────────────────────────────────────────────────────┘

Default Policy and Rule Order

┌──────────────────────────────────────────────────────────────┐
│  THE FIRST MATCHING RULE WINS                                │
│                                                              │
│  Chain INPUT:                                                │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ 1. -i lo -j ACCEPT                                     │  │
│  │ 2. -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT│  │
│  │ 3. -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT      │  │
│  │ 4. -p tcp --dport 80 -j ACCEPT                        │  │
│  │ 5. -j DROP                                             │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  A packet that matches rule 3 is accepted and stops.         │
│  A packet that matches none is dropped by rule 5.            │
│  The default policy is the fallback if no rule matches.      │
└──────────────────────────────────────────────────────────────┘

The Lockout Trap

┌──────────────────────────────────────────────────────────────┐
│  SETTING THE POLICY TO DROP WITHOUT ALLOWING SSH LOCKS YOU OUT│
│                                                              │
│  ❌ Incorrect:                                               │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ iptables -P INPUT DROP                                 │  │
│  │ # No SSH rule → remote session is dropped              │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  ✅ Correct:                                                 │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ iptables -A INPUT -p tcp --dport 22 -j ACCEPT          │  │
│  │ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,  │  │
│  │   RELATED -j ACCEPT                                    │  │
│  │ iptables -P INPUT DROP                                 │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Default table	`filter`
Default chains	`INPUT`, `OUTPUT`, `FORWARD`
Append rule	`-A CHAIN`
Insert rule	`-I CHAIN N`
Delete rule	`-D CHAIN N`
Set policy	`-P CHAIN TARGET`
List rules	`-L -n -v`
Line numbers	`--line-numbers`
Save rules	`iptables-save > file`
Restore rules	`iptables-restore < file`
Accept target	`-j ACCEPT`
Drop target	`-j DROP`
Reject target	`-j REJECT`

Key takeaways:

iptables is organized into tables and chains. The filter table is the default and contains the INPUT, OUTPUT, and FORWARD chains. The nat table contains the address-translation rules, and the mangle table contains the header-modification rules .
The first matching rule wins. The rules in a chain are evaluated in order, and the packet’s fate is determined by the first rule that matches. The default policy applies when no rule matches.
The default policy is the fallback. A policy of DROP denies all traffic that is not explicitly allowed. A policy of ACCEPT allows all traffic that is not explicitly denied. The secure choice is DROP for INPUT and FORWARD, with explicit rules for every required service.
The loopback and established-connection rules are essential. Without the loopback rule, local services cannot communicate. Without the established-connection rule, replies to outgoing connections are dropped.
The rules are not persistent across reboots. The iptables-save and iptables-restore commands save and restore the rules. The iptables-persistent package on Debian and the iptables-services package on RHEL automate the restore at boot.
Setting the policy to DROP without allowing SSH locks the administrator out. The SSH rule must be in place before the policy is changed, or the remote session is dropped and the server is unreachable.

Remember: iptables is the packet filter. The filter table is the default and contains the INPUT, OUTPUT, and FORWARD chains. The rules are evaluated in order, and the first match wins. The default policy is the fallback. The loopback and established-connection rules keep the basic services working. The -A flag appends, the -I flag inserts, and the -D flag deletes. The iptables-save and iptables-restore commands make the rules persistent. The firewall is only as good as its rule order and its default policy; a rule that is never reached is a rule that does not exist.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!