{"id":5614,"date":"2019-11-29T03:51:46","date_gmt":"2019-11-29T03:51:46","guid":{"rendered":"https:\/\/www.hostinger.com\/tutorials\/?p=5614"},"modified":"2026-10-27T20:49:41","modified_gmt":"2026-10-27T20:49:41","slug":"iptables-tutorial","status":"publish","type":"post","link":"\/au\/tutorials\/iptables-tutorial\/","title":{"rendered":"Iptables tutorial: How to configure a Linux firewall on VPS"},"content":{"rendered":"

Iptables is a Linux firewall tool that lets you control traffic to and from your VPS by configuring rules to allow, block, forward, and filter data packets. It works through the netfilter framework in the Linux kernel and gives you precise control over which packets reach your server. <\/p>

Iptables organizes rules into tables, chains, matches, and targets. The safest setup order starts with allowing SSH and established connections before applying any DROP rules. Rules must be saved explicitly to persist after a reboot. Both UFW and nftables are viable alternatives depending on your needs.<\/p>

The main steps to configure iptables are:<\/p>

    \n
  1. Check and install iptables.<\/li>\n\n\n\n
  2. List existing rules.<\/li>\n\n\n\n
  3. Allow SSH before applying restrictive rules.<\/li>\n\n\n\n
  4. Add basic firewall rules.<\/li>\n\n\n\n
  5. Open common service ports.<\/li>\n\n\n\n
  6. Delete or flush rules.<\/li>\n\n\n\n
  7. Save rules permanently.<\/li>\n<\/ol>

    What is iptables?<\/h2>

    Iptables is a command-line firewall tool that manages Linux firewall rules. It works via the netfilter framework, a packet-filtering system built into the Linux kernel. Every packet that enters or leaves your server passes through netfilter. Iptables supplies the rules that decide whether to allow, block, or handle the traffic.<\/p>

    Iptables handles IPv4 traffic. For IPv6, you need ip6tables. This uses the same syntax but operates on a different set of rules.<\/p>

    Understanding iptables starts with knowing these five core concepts:<\/p>

    Concept<\/strong><\/td>What it is<\/strong><\/td><\/tr>
    Table<\/td>A collection of chains grouped by purpose. The main tables are filter<\/strong>, nat<\/strong>, and mangle<\/strong>.<\/td><\/tr>
    Chain<\/td>A list of rules within a table. Built-in chains include INPUT<\/strong>, OUTPUT<\/strong>, and FORWARD<\/strong>.<\/td><\/tr>
    Rule<\/td>A condition that a packet is checked against. Iptables applies the target if the packet matches, <\/td><\/tr>
    Match<\/td>The criteria used to evaluate a packet – source IP, destination port, protocol, and so on.<\/td><\/tr>
    Target<\/td>The action taken when a packet matches a rule: ACCEPT<\/strong>, DROP<\/strong>, RETURN<\/strong>, or REJECT<\/strong>.<\/td><\/tr><\/tbody><\/table><\/figure>

    Basic VPS security<\/a> configurations use the filter table containing three default chains. INPUT handles incoming packets to the server. OUTPUT handles packets leaving the server. FORWARD handles packets routed to a destination other than the server.<\/p>

    How does iptables work?<\/h3>

    Iptables evaluates packets one by one, from top to bottom. For each packet, it starts at the top of a chain and checks the rules in order until it finds a match. When a packet matches a rule, iptables applies that rule’s target (such as ACCEPT or DROP) and stops checking the remaining rules in the same chain.<\/p>

    Rule order is critical. An earlier rule can allow or block traffic before iptables ever evaluates later rules. If a broad DROP rule appears before your SSH allow rule, matching traffic is dropped immediately, and the SSH rule is never reached.<\/p>

    There are two ways to add rules: <\/p>

      \n
    1. The -A<\/strong> flag appends a rule to the bottom of a chain.<\/li>\n\n\n\n
    2. The -I<\/strong> flag inserts a rule at a specific position.  <\/li>\n<\/ol>

      You’ll lock yourself out if you append a broad DROP rule before your SSH allow rule. Adding rules in the right order prevents that.<\/p>

      Always add essential allow rules (especially for SSH) before adding restrictive firewall rules to block or drop traffic.<\/p>

      What is the difference between iptables, ip6tables, and nftables?<\/h3>

      While iptables handles IPv4 firewall rules, ip6tables handles IPv6 firewall rules using the same command syntax. That said, the two rule sets are completely separate, so rules in iptables don’t affect IPv6 traffic, and vice versa.<\/p>

      Nftables is the newer Linux firewall framework. It replaces both iptables and ip6tables, handling both IPv4 and IPv6 traffic in a single rule set using a cleaner syntax. On modern Ubuntu versions, iptables commands can run through an nftables backend transparently, meaning your iptables rules are actually stored and processed by nftables even though you continue using the familiar iptables syntax.<\/p>

      For users who want simpler firewall management on Ubuntu without writing iptables rules directly, UFW is covered later in this guide.<\/p>

      Tool<\/strong><\/td>Handles<\/strong><\/td>Key points<\/strong><\/td><\/tr>
      iptables<\/strong><\/td>IPv4 only<\/td>Uses classic syntax. Rules apply only to IPv4 traffic and have no effect on IPv6<\/td><\/tr>
      ip6tables<\/strong><\/td>IPv6 only<\/td>Uses the same command syntax as iptables. Rules are completely separate from iptables and apply only to IPv6 traffic<\/td><\/tr>
      nftables<\/strong><\/td>IPv4 and IPv6<\/td>Newer Linux firewall framework that replaces both iptables and ip6tables. Uses a single rule set for both protocols and cleaner syntax. On modern Ubuntu, iptables commands often run through an nftables backend. Iptables rules are processed by nftables<\/td><\/tr><\/tbody><\/table><\/figure>

      How to configure iptables on Ubuntu VPS<\/h2>

      The safest way to set up a VPS<\/a> firewall with iptables is to build rules in a specific order: check existing rules first, then allow SSH, established connections, and required service ports before blocking anything. <\/p>

      Apply DROP rules last – skipping this order can lock administrators out of a server they can no longer reach.<\/p>

      1. Check and install iptables<\/h3>

      Iptables comes preinstalled on most Linux distributions. This tutorial uses Ubuntu VPS as the main example. To check whether iptables is already available on your system, run:<\/p>

      iptables --version <\/code><\/pre>
      You’ll know iptables is already installed if the command returns a version number. On modern Ubuntu versions, this may show a reference to the nftables backend, meaning iptables commands are processed by nftables under the hood. The syntax stays the same either way.<\/p>
      If iptables is not installed, run:<\/p>
      sudo apt update \n\nsudo apt install iptables <\/code><\/pre>
      2. List existing iptables rules<\/h3>
      Check your existing rules before adding new ones. An existing rule may already allow or block traffic you intend to configure, and adding duplicate or conflicting rules causes unpredictable behavior.<\/p>
      List all current rules with verbose output and line numbers:<\/p>
      sudo iptables -L -v -n --line-numbers <\/code><\/pre>
      The -n<\/strong> flag prints IP addresses and port numbers numerically instead of resolving them to hostnames, which is faster and easier to read. Line numbers identify each rule’s position in the chain – you will need them to delete or insert rules at specific positions. <\/p>
      The packet and byte counters in the output show whether traffic actually matches each rule, which helps with troubleshooting.<\/p>
      3. Allow SSH before changing firewall rules<\/h3>
          
      \n        \n            \n                \n            <\/svg>\n            Warning        <\/span>\n        
      \n            Applying restrictive firewall rules before allowing SSH will lock you out of your VPS. There is no error message – the connection simply drops, and you lose access.        <\/p>\n    <\/div>\n\n     <\/p>
      Allow SSH before adding any DROP or REJECT rules. The default SSH port is 22:<\/p>
      sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT <\/code><\/pre>
      This rule allows SSH from any IP address. For stronger security, restrict it to a trusted IP or range later. If you’ve changed your VPS SSH port<\/a>, replace 22 with that port number instead. Check your server configuration by opening this file if you’re not sure:<\/p>
      sudo nano \/etc\/ssh\/sshd_config <\/code><\/pre>
      Passwords are the most common SSH authentication method, but setting up SSH keys<\/a> is more secure and worth doing before you lock down your firewall.<\/p>
      After adding the SSH rule, keep your current session open and test access from a second terminal window before saving any restrictive rules. It’s safe to continue if the second connection succeeds.<\/p>
      4. Add basic iptables firewall rules<\/h3>
      The remaining rules build out your firewall in order of priority. Add them in the sequence below to avoid blocking traffic you need.<\/p>
      Allow localhost traffic<\/strong><\/p>
      Traffic on the loopback interface stays within the server itself. Blocking it breaks internal communication between services running on the same machine, such as a web application connecting to a local database:<\/p>
      sudo iptables -A INPUT -i lo -j ACCEPT <\/code><\/pre>
      Allow established and related connections<\/strong><\/p>
      This rule allows traffic that belongs to connections your server already initiated or accepted. Without it, responses to outgoing requests get blocked:<\/p>
      sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT <\/code><\/pre>
      Allow HTTP and HTTPS<\/strong><\/p>
      Open ports 80 and 443 to allow web traffic:<\/p>
      sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT \n\nsudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT <\/code><\/pre>
      Block a specific IP address<\/strong><\/p>
      To drop all traffic from a single IP address:<\/p>
      sudo iptables -A INPUT -s 192.0.2.1 -j DROP <\/code><\/pre>
      Block an IP range<\/strong><\/p>
      Use the iprange<\/strong> module to drop traffic from a range of addresses:<\/p>
      sudo iptables -A INPUT -m iprange --src-range 192.0.2.1-192.0.2.254 -j DROP <\/code><\/pre>
      Drop invalid packets<\/strong><\/p>
      Invalid packets don’t belong to any known connection and are often used in network attacks. Drop them before they reach your services:<\/p>
      sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP <\/code><\/pre>
      Drop all other incoming traffic<\/strong><\/p>
      Add this rule last. It drops any incoming traffic that hasn’t matched an earlier ACCEPT rule. Placing it before your allow rules will block everything, including SSH:<\/p>
      sudo iptables -A INPUT -j DROP <\/code><\/pre>
      You can set the INPUT chain policy to DROP instead (`iptables -P INPUT DROP`). Both approaches work; the rule above is simpler and safer while you’re still testing.<\/p>
      5. Open common service ports with iptables<\/h3>
      Each service running on your VPS uses a specific port, and iptables needs an explicit rule to allow traffic on that port:<\/p>
      Service<\/strong><\/td>Protocol<\/strong><\/td>Port<\/strong><\/td>Notes<\/strong><\/td><\/tr>
      SSH<\/td>TCP<\/td>22<\/td>Change the default port if possible<\/td><\/tr>
      HTTP<\/td>TCP<\/td>80<\/td>Required for unencrypted web traffic<\/td><\/tr>
      HTTPS<\/td>TCP<\/td>443<\/td>Required for encrypted web traffic<\/td><\/tr>
      MySQL<\/td>TCP<\/td>3306<\/td>Restrict to trusted IPs only<\/td><\/tr>
      PostgreSQL<\/td>TCP<\/td>5432<\/td>Restrict to trusted IPs only<\/td><\/tr>
      SMTP<\/td>TCP<\/td>25 or 587<\/td>Only if running a mail server (use 587 for client submission)<\/td><\/tr>
      IMAP<\/td>TCP<\/td>993<\/td>Only if running a mail server<\/td><\/tr><\/tbody><\/table><\/figure>
      Database ports like 3306 and 5432 should never be opened to the public internet. Restrict them to a trusted IP address or a private network interface instead:<\/p>
      sudo iptables -A INPUT -p tcp --dport 3306 -s 192.0.2.1 -j ACCEPT <\/code><\/pre>
      Replace 192.0.2.1<\/strong> with the IP address of the machine that needs database access.<\/p>
      6. Delete or flush iptables rules<\/h3>
      Deleting a specific rule removes it without touching the rest of your configuration; flushing removes all rules at once.<\/p>
      Deleting a specific rule<\/strong><\/p>
      To remove one rule without affecting the rest, use its line number. First, list rules with line numbers:<\/p>
      sudo iptables -L INPUT --line-numbers <\/code><\/pre>
      Then delete the rule at the position you want to remove. To delete rule number 3 from the INPUT chain:<\/p>
      sudo iptables -D INPUT 3 <\/code><\/pre>
      Flushing all rules<\/strong><\/p>
      To remove all rules at once, use the -F<\/strong> flag:<\/p>
      sudo iptables -F <\/code><\/pre>
          
      \n        \n            \n                \n            <\/svg>\n            Warning        <\/span>\n        
      \n            Flushing the rules on a remote VPS removes all allow rules and all block rules.  Flushing leaves you locked out if your default chain policy is DROP. When the default policy is ACCEPT, flushing exposes all ports. Know your default policy before flushing.        <\/p>\n    <\/div>\n\n     <\/p>
      DROP vs REJECT<\/strong><\/p>
      When blocking traffic, you have two options. DROP silently discards the packet: the sender gets no response and the connection eventually times out. REJECT discards the packet and sends an error response to the sender, making troubleshooting easier but also confirming to the sender that the port exists.<\/p>
      Use DROP for public-facing rules where you don’t want to reveal information about your server. Use REJECT in internal or development environments where faster feedback is useful.<\/p>
      7. Save iptables rules permanently<\/h3>
      Iptables rules are stored in memory and don’t survive a reboot by default. To keep your rules after restarting the VPS, save them to a file.<\/p>
      Install iptables-persistent<\/strong><\/p>
      The iptables-persistent<\/strong> package automatically saves and loads rules. On Ubuntu, installing it also installs netfilter-persistent<\/strong>, which is the underlying service that loads the saved rules at boot:<\/p>
      sudo apt install iptables-persistent <\/code><\/pre>
      During installation, you’ll be prompted to save your current IPv4 and IPv6 rules. Choose Yes<\/strong> for both.<\/p>
      Save rules manually<\/strong><\/p>
      If you installed iptables-persistent<\/strong>, the \/etc\/iptables\/<\/strong> directory already exists. After adding or changing rules, save them so they persist through reboots:<\/p>
      sudo netfilter-persistent save <\/code><\/pre>
      This writes both IPv4 and IPv6 rules to \/etc\/iptables\/rules.v4<\/strong> and \/etc\/iptables\/rules.v6<\/strong>, respectively.”<\/p>
      Restore rules manually<\/strong><\/p>
      When you need to reload saved rules without rebooting:<\/p>
      sudo iptables-restore < \/etc\/iptables\/rules.v4 \n\nsudo ip6tables-restore < \/etc\/iptables\/rules.v6 <\/code><\/pre>
      Verify after reboot<\/strong><\/p>
      After restarting your VPS, confirm that the rules loaded correctly:<\/p>
      sudo iptables -L -v -n <\/code><\/pre>
      The output should match the rules you saved before rebooting.<\/p>
      How to configure NAT and port forwarding with iptables<\/h2>
      NAT and port forwarding let your VPS act as a gateway, router, VPN endpoint<\/a>, or traffic forwarder. They route packets between networks or redirect traffic from one port to another. These rules use the NAT table, not the filter table.<\/p>
      Port forwarding also requires IP forwarding to be enabled in the kernel. To enable it temporarily:<\/p>
      sudo sysctl -w net.ipv4.ip_forward=1 <\/code><\/pre>
      To make it permanent, add the following line to \/etc\/sysctl.conf<\/strong>:<\/p>
      net.ipv4.ip_forward=1 <\/code><\/pre>
      Then apply the change:<\/p>
      sudo sysctl -p <\/code><\/pre>
      To forward traffic arriving on port 80 to a different host on your network:<\/p>
      sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.0.2.1:80 \n\nsudo iptables -t nat -A POSTROUTING -j MASQUERADE <\/code><\/pre>
      If your FORWARD<\/strong> chain policy is set to DROP<\/strong>, you also need to allow the forwarded traffic explicitly:<\/p>
      sudo iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j ACCEPT<\/code><\/pre>
      iptables vs UFW: Which firewall tool should you use?<\/h2>
      Iptables gives you direct control over every aspect of your firewall, such as rule order, NAT, port forwarding, custom chains, and compatibility with existing scripts. But that control comes at a cost – the syntax is verbose, rule order is strict, and mistakes on a remote VPS can lock you out instantly.<\/p>
      UFW (Uncomplicated Firewall) is a frontend for iptables that simplifies common firewall tasks on Ubuntu. When you only need to allow SSH, HTTP, and HTTPS, you can configure a firewall on Ubuntu using UFW<\/a> with a handful of commands and no risk of rule-ordering mistakes.<\/p>
      Nftables is the more modern long-term replacement for iptables. It handles IPv4 and IPv6 in a single rule set and uses a cleaner syntax, but it requires learning a new framework from scratch.<\/p>
      The right tool depends on what you need:<\/p>