OS - Linux - Firewall - iptables - Notes

Show rules with line numbers:

iptables -n -L --line-numbers

Source:commandlinefu.com - Show current iptables rules, with line numbers

Delete line number 1 from chain fail2ban-SSH:

iptables -D fail2ban-SSH 1 

Allow all traffic on the loopback interface:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

Allow incoming tcp traffic on interface eth0 for ports 22, 80, and 443:

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

Allow outgoing tcp traffic on interface eth0 for port 25 (SMTP):

sudo iptables -A OUTPUT -o eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

Allow outgoing traffic on eth0 for port 80 (HTTP), and 443 (HTTPS) in one go (multiport):

iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT

Configure to drop all traffic for which no specific rules exist:

sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT DROP

Block all access to MySQL TCP/3306 and only allow a specific IP, also add a comment to each line:

iptables -A INPUT -i eth0 -p tcp --dport 3306 -s 10.0.1.10 -m state --state NEW,ESTABLISHED -j ACCEPT -m comment --comment 'Allow MySQL access from server01.'
iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -d 10.0.1.10 -m state --state ESTABLISHED -j ACCEPT -m comment --comment 'Allow MySQL access from server01.'
iptables -A INPUT -i eth0 -p tcp --dport 3306 -j DROP -m comment --comment 'Block all MySQL access.'

Flush (delete) all rules:

iptables --flush

Tested to work on Debian 7.

# Save the ruleset.
sudo -s
mkdir /etc/iptables
/sbin/iptables-save > /etc/iptables/iptables.rules
exit

Create the iptables file:

sudo vi /etc/network/if-pre-up.d/iptables

Add the follwoing to /etc/network/if-pre-up.d/iptables

#!/bin/sh
/sbin/iptables-restore < /etc/iptables/iptables.rules

Correct permissions on the iptables file:

sudo chown root /etc/network/if-pre-up.d/iptables
sudo chmod 0700 /etc/network/if-pre-up.d/iptables