How to configure firewall rules with iptables on Linux

What is iptables and how it protects Linux servers

Managing the network traffic entering and leaving a Linux server is one of the most critical tasks for infrastructure security. Iptables is the standard command-line tool in the Linux kernel used to configure the packet filtering system known as Netfilter. In practice, it acts like a strict security guard at a venue door, checking the identity, origin, and destination of every piece of data — called packets — trying to enter or leave the computer.

When configured correctly, iptables prevents unauthorized access, blocks break-in attempts, and mitigates denial of service (DDoS) attacks, where malicious bots try to crash a site by sending millions of simultaneous fake requests. Before launching any application, such as monitored systems in isolated environments, understanding the logic behind firewall rules prevents headaches and critical data leaks.

Understanding tables, chains, and inspection order

To master iptables, you must understand that it organizes work into three main concepts: tables, chains, and rules. Tables divide work by objectives. The most used table is filter, focused precisely on deciding whether a packet can pass or must be rejected. Other tables handle translating IP addresses or modifying packets along the way.

Inside each table are chains, which are the checkpoints where packets pass. The INPUT chain handles traffic arriving at the server itself, OUTPUT handles what leaves, and FORWARD manages packets just passing through the server toward another destination. Each incoming packet is compared against rules from top to bottom. As soon as a rule gives the verdict to accept or block, the search stops and the packet fate is sealed.

Blocking denial of service attacks with rate limiting

Denial of service attacks usually overload the server with thousands of connections per second, exhausting memory and processing capacity. To mitigate this issue without shutting down the service for legitimate users, we can use the hashlimit module or basic iptables rate limiting. This restricts how many requests the same IP address can make within a specific time interval.

In practice, we create a rule telling the system: if an IP tries to open more than a safe number of new connections on a web service port within a few seconds, subsequent attempts will be summarily ignored or rejected. This type of shielding is essential to maintain machine stability, working alongside good practices of system maintenance and failure recovery under high operational pressure.

Step-by-step guide to create a secure firewall script

Let us create a functional and secure firewall template that blocks everything by default and opens only what is necessary for basic server operation. Open the terminal with administrative privileges and follow the steps below to apply and validate your rules.

1. Set the default policy to drop all incoming and forwarding traffic, allowing only outgoing traffic:

   iptables -P INPUT DROP
   iptables -P FORWARD DROP
   iptables -P OUTPUT ACCEPT

2. Allow loopback traffic (internal communication of the machine itself) and established connections to prevent lockouts:

   iptables -A INPUT -i lo -j ACCEPT
   iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

3. Allow remote access via SSH by defining a secure port and protecting against brute-force attacks by limiting new connection rates:

   iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m hashlimit --hashlimit-above 3/min --hashlimit-burst 5/src -j DROP
   iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Granular filtering and permanent rule saving

Beyond preventing crashes, granular filtering allows isolating internal services or granting access exclusively to trusted partner or administrator IP addresses. For example, if you want only a secure IP to access your database panel, simply create a rule targeted specifically at that source, refusing everything else.

An important detail is that, by default, iptables rules disappear when the server reboots. To avoid losing your configuration, you must save the current rule set using distribution-specific tools, such as the iptables-persistent package. This ensures the firewall reloads automatically with the same protections every time the machine boots.

Conclusion

Mastering iptables is a fundamental skill for any professional managing Linux servers, combining denial-of-service attack protection with surgical control over data flow. By structuring restrictive policies, applying smart rate limits, and ensuring rule persistence, you build a robust and reliable defense layer.

Keeping the firewall updated and monitoring network behavior for anomalies completes the infrastructure security cycle, ensuring critical applications run without unwanted surprises.