Basic Commands

There are several operations you can do with iptables. You start with three default chains INPUT, OUTPUT and FORWARD that you cannot delete. Let’s look at the operations to administer chains:

Creating a new chain:

1

iptables -N chain

Delete an empty chain:

1

iptables -X chain

Change the default rule for a starting chain:

1

iptables -P chain status

Example:

1

iptables -P INPUT DROP

or

1

iptables --policy FORWARD DROP

List the rules in a chain:

1

iptables -L chain

Remove rules from a chain:

1

iptables -F chain

or

1

iptables --flush chain

Empty rules from another table (e.g., NAT):

1

iptables --table nat --flush chain

Reset the bit and packet counters of a chain:

1

iptables -Z chain

Manipulating Rules in a Chain

Add a new rule to the chain:

1

iptables -A

Insert a new rule at a position in the chain:

1

iptables -I

Replace a rule at a position in the chain:

1

iptables -R

Delete a rule at a position in the chain:

1

iptables -D

Delete the first matching rule in a chain:

1

iptables -D

Displaying Your IPTables Configuration

Display the entire filter table:

1

iptables –L –v

Display only the NAT table:

1

iptables –t nat –L –v

Usage Examples

To allow packets on the telnet port coming from a local network:

1

iptables --append INPUT --protocol tcp --destination-port telnet --source 192.168.13.0/24 --jump ACCEPT

To ignore other incoming packets on the telnet port:

1

iptables -A INPUT -p tcp --dport telnet -j DROP

To reject incoming packets on port 3128, often used by proxies, then add a comment:

1

iptables -A INPUT -p tcp --dport 3128 -j REJECT --reject-with tcp-reset -m comment --comment "Rejecting default proxy port"

To perform automatic NAT for all packets leaving through the ppp0 interface (often representing the internet connection):

1

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Disable all rules without disconnecting:

1

iptables -F && iptables -X && iptables -P INPUT ACCEPT && iptables -OUTPUT ACCEPT

Resources

Edit this page

Last updated 06 May 2013, 15:42 CEST. history