If you're looking to work with `iptables` on a Linux system and want to get started with setting up new
rules or configurations, here's a guide to help you:
### Introduction to `iptables`
`iptables` is a powerful tool for configuring network traffic rules on Linux systems. It allows you to
control incoming and outgoing traffic based on various criteria. The basic structure involves defining
rules for different chains and tables.
### Basic Concepts
- **Tables**: Containers for chains of rules. The most common tables are `filter`, `nat`, and `mangle`.
- **Chains**: Predefined sets of rules. For example, `INPUT`, `FORWARD`, and `OUTPUT` are common
chains in the `filter` table.
- **Rules**: Define how traffic is handled. Rules can match traffic based on criteria like IP address, port,
protocol, etc., and specify actions (ACCEPT, DROP, REJECT, etc.).
### Viewing Current Rules
Before adding new rules, it’s useful to view the current configuration:
```bash
sudo iptables -L -v -n
```
- `-L`: List rules
- `-v`: Verbose output
- `-n`: Numeric output (IP addresses and port numbers)
### Adding New Rules
#### 1. **Allow SSH Traffic (Port 22)**
To allow incoming SSH traffic, add the following rule to the `INPUT` chain of the `filter` table:
```bash
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
```
- `-A INPUT`: Append the rule to the `INPUT` chain
- `-p tcp`: Match TCP protocol
- `--dport 22`: Match destination port 22
- `-j ACCEPT`: Action to take (allow the traffic)
#### 2. **Block Incoming Traffic from a Specific IP**
To block traffic from a specific IP address:
```bash
sudo iptables -A INPUT -s 192.168.1.100 -j DROP
```
- `-s 192.168.1.100`: Source IP address
- `-j DROP`: Action to take (drop the traffic)
#### 3. **Allow Traffic to a Specific Port**
To allow incoming traffic to a specific port (e.g., HTTP on port 80):
```bash
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
```
### Saving and Persisting Rules
Changes made with `iptables` are not persistent across reboots by default. To save and restore rules:
#### On Debian/Ubuntu:
1. **Save Rules**:
```bash
sudo iptables-save > /etc/iptables/rules.v4
```
2. **Install `iptables-persistent` to auto-load rules on boot**:
```bash
sudo apt-get install iptables-persistent
```
#### On Red Hat/CentOS:
1. **Save Rules**:
```bash
sudo service iptables save
```
2. **Restart `iptables` to apply changes**:
```bash
sudo systemctl restart iptables
```
### Example Rules
#### Allowing All Traffic from a Local Network:
```bash
sudo iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
```
#### Dropping All Traffic Except for Established Connections:
```bash
sudo iptables -P INPUT DROP
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
```
### Troubleshooting
- **Check Logs**: If rules aren’t working as expected, check logs for dropped packets or errors:
```bash
sudo tail -f /var/log/syslog
```
- **Flush Rules**: To remove all rules and start fresh:
```bash
sudo iptables -F
```
### Conclusion
`iptables` is a robust tool for network traffic management on Linux systems. Understanding its basic
commands and concepts can help you secure and manage your network effectively. Always test new
rules carefully to avoid inadvertently blocking necessary traffic.
