Notes

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
======OS - Linux - Firewall - iptables - Notes======

Show rules with line numbers:
<code>
iptables -n -L --line-numbers
</code>
Source:[[http://www.commandlinefu.com/commands/view/1100/show-current-iptables-rules-with-line-numbers|commandlinefu.com - Show current iptables rules, with line numbers]] 

Delete line number 1 from chain fail2ban-SSH:
<code>
iptables -D fail2ban-SSH 1 
</code>

Allow all traffic on the loopback interface:
<code>
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT
</code>

Allow incoming tcp traffic on interface eth0 for ports 22, 80, and 443:
<code>
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
</code>

Allow outgoing tcp traffic on interface eth0 for port 25 (SMTP):
<code>
sudo iptables -A OUTPUT -o eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
</code>

Allow outgoing traffic on eth0 for port 80 (HTTP), and 443 (HTTPS) in one go (multiport):
<code>
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
</code>

Configure to drop all traffic for which no specific rules exist:
<code>
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT DROP
</code>

Block all access to MySQL TCP/3306 and only allow a specific IP, also add a comment to each line:
<code bash>
iptables -A INPUT -i eth0 -p tcp --dport 3306 -s 10.0.1.10 -m state --state NEW,ESTABLISHED -j ACCEPT -m comment --comment 'Allow MySQL access from server01.'
iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -d 10.0.1.10 -m state --state ESTABLISHED -j ACCEPT -m comment --comment 'Allow MySQL access from server01.'
iptables -A INPUT -i eth0 -p tcp --dport 3306 -j DROP -m comment --comment 'Block all MySQL access.'
</code>

Flush (delete) all rules:
<code>
iptables --flush
</code>


=====Save ruleset & Apply at reboot=====
// Tested to work on Debian 7. //

<code>
# Save the ruleset.
sudo -s
mkdir /etc/iptables
/sbin/iptables-save > /etc/iptables/iptables.rules
exit
</code>

Create the iptables file:
<code>
sudo vi /etc/network/if-pre-up.d/iptables
</code>

Add the follwoing to /etc/network/if-pre-up.d/iptables
<code>
#!/bin/sh
/sbin/iptables-restore < /etc/iptables/iptables.rules
</code>

Correct permissions on the iptables file:
<code>
sudo chown root /etc/network/if-pre-up.d/iptables
sudo chmod 0700 /etc/network/if-pre-up.d/iptables
</code>