How to configure firewall rules with iptables on Linux

What is iptables and how packet filtering works

When we browse the internet, our data travels in small pieces called packets. On the Linux operating system, iptables acts as the doorman, inspecting every single packet entering or leaving the machine. In practice, this means it decides whether network traffic is allowed to pass, should be dropped, or needs modification before continuing its journey. This fundamental packet filtering mechanism happens at the network layer of the OSI model, ensuring vulnerable ports stay protected against unwanted internet access.

For those who have previously needed to unblock ports on Linux UFW firewall, iptables is the low-level utility doing the heavy lifting behind the scenes. While friendlier tools simplify configuration interfaces, iptables offers surgical control over every security rule. It operates directly inside the operating system kernel, the heart of Linux, guaranteeing high performance and efficiency even under heavy server workloads.

The internal architecture: tables, chains, and rules

The structure of iptables is divided into tables, which group rules according to the type of operation performed. The most famous and widely used table in daily operations is the filter table, responsible for deciding whether a packet can enter, leave, or pass through the server. Other tables like nat handle network address translation, allowing multiple computers to share a single public IP address, while the mangle table adjusts specific details of packet headers.

Inside each table, we find structures called chains. The main built-in chains are INPUT, which handles packets destined for the local machine, OUTPUT, which manages traffic generated by the server, and FORWARD, which deals with packets merely passing through the system toward another network. Every network packet must pass through these chains, where rules are evaluated one by one from top to bottom until one of them determines the final destination of the packet.

Understanding default policies and traffic behavior

Before adding any specific rules, every firewall needs a default policy. In practice, this policy defines what happens to a packet if it fails to match any rule registered in the chain. The safest security recommendation in production environments is adopting a restrictive policy, blocking all incoming traffic by default and allowing only what is strictly necessary for system operation.

When we configure iptables to drop everything on input, we prevent forgotten services or newly discovered vulnerabilities from being exposed to the outside world. If the server needs to respond to external requests, such as a web site or database service, we create targeted exceptions to open those specific ports. This principle of least privilege drastically reduces the attack surface of the server against malicious intrusions.

How to create and apply practical rules step by step

To interact with iptables, we use commands executed with administrative privileges in the Linux terminal. The basic syntax involves choosing the table, the desired operation such as appending (-A) or inserting (-I), the corresponding chain, and the filtering criteria. Remember that rules created directly via the command line disappear after a server reboot, requiring you to save the configurations using distribution-specific packages.

Below is a practical example of an initial configuration to protect a Linux server, allowing secure SSH connections and standard web traffic:

# Set default policies to drop all incoming traffic
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow already established or related traffic
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -J ACCEPT

# Allow traffic on the loopback interface (localhost)
sudo iptables -A INPUT -i lo -J ACCEPT

# Allow SSH connections on port 22
sudo iptables -A INPUT -p tcp --dport 22 -J ACCEPT

# Allow HTTP and HTTPS web traffic
sudo iptables -A INPUT -p tcp --dport 80 -J ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -J ACCEPT

After applying security rules, it is essential to verify that essential services remain accessible and no ports were mistakenly blocked. To validate network behavior and audit active connections on the machine, you can how to use the ss command on Linux to audit network connections accurately and quickly. This audit ensures the firewall is performing its job without disrupting system operations. To explore these architectural concepts further in production, see our related technical analysis on How to test electromechanical relays on board with a multimeter.

Conclusion and best practices in firewall management

Mastering iptables is an essential skill for any systems administrator or infrastructure engineer seeking absolute control over Linux network security. Understanding how tables, chains, and policies work together allows you to build robust barriers against cyber attacks and unauthorized access. Although modern firewall wrappers abstract some of this complexity, knowing the solid foundation of iptables ensures rapid diagnosis and definitive solutions when complex network issues arise.

Always maintain the habit of reviewing your rules periodically, removing old exceptions that are no longer in use and documenting every important change in your environment. Information security is a continuous process of monitoring, tuning, and rigorous testing to shield your infrastructure against constantly evolving threats.