iptables(8)
iptables is a command-line firewall utility for configuring Linux kernel netfilter packet filtering rules and network address translation (NAT).
Synopsis
iptables [-t table] {-A|-C|-D|-I|-R|-L|-S|-F|-Z|-N|-X|-P|-E} chain rule-specification [options]Description
iptables is the userspace command-line interface to the Linux kernel's netfilter framework, allowing administrators to set up, maintain, and inspect IP packet filtering rules. It operates on four main tables (filter, nat, mangle, raw) containing chains that process packets at different stages of the network stack.
Rules are matched sequentially; the first matching rule determines the packet's fate (ACCEPT, DROP, REJECT, or custom chain). Common usage includes blocking ports, redirecting traffic, implementing NAT, and building stateful firewalls. Modern systems often use iptables-legacy or nftables as alternatives.
Common options
| Flag | What it does |
|---|---|
-t table | Specify the table (filter, nat, mangle, raw, security); default is filter |
-A chain | Append a rule to the end of the specified chain |
-I chain [rulenum] | Insert a rule at the specified position (default 1, start of chain) |
-D chain [rulenum] | Delete a rule by number or specification from the chain |
-L [chain] | List rules in the specified chain or all chains |
-F [chain] | Flush (delete all) rules from the specified chain or all chains |
-P chain policy | Set the default policy (ACCEPT or DROP) for the specified chain |
-j target | Specify the target action for matching packets (ACCEPT, DROP, REJECT, DNAT, SNAT, etc.) |
-p protocol | Match packets by protocol (tcp, udp, icmp, or a protocol number) |
-s source | Match packets from a source IP address or network (CIDR notation supported) |
-d destination | Match packets destined for an IP address or network |
--dport port | Match packets to a destination port (use with -p tcp or udp) |
Examples
List all rules in the filter table in numeric format (shows IP addresses instead of hostnames)
iptables -L -nAllow incoming SSH connections on port 22
iptables -A INPUT -p tcp --dport 22 -j ACCEPTAllow HTTP and HTTPS traffic
iptables -A INPUT -p tcp --dport 80 -j ACCEPT && iptables -A INPUT -p tcp --dport 443 -j ACCEPTAccept all traffic from the 192.168.1.0/24 subnet
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPTDrop all remaining incoming traffic (apply after allowing specific ports)
iptables -A INPUT -j DROPDelete the SSH allow rule from the INPUT chain
iptables -D INPUT -p tcp --dport 22 -j ACCEPTEnable IP masquerading (NAT) for outbound traffic on eth0
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEFlush all rules and set default policies to ACCEPT (remove firewall)
iptables -F && iptables -P INPUT ACCEPT && iptables -P FORWARD ACCEPT && iptables -P OUTPUT ACCEPT