iptables Command in Linux: Firewall Rules

Quick take: The iptables command configures the Linux kernel firewall through rules in chains (INPUT, OUTPUT, FORWARD). List rules with iptables -L -n -v and add them with -A. For everyday use on Ubuntu, the simpler ufw sits on top of iptables.

Introduction

The iptables command is the traditional, powerful interface to the Linux kernel's netfilter firewall. It organises rules into chains — INPUT for incoming traffic, OUTPUT for outgoing, and FORWARD for routed traffic — and processes packets against them in order. It is more complex than ufw but offers complete control.

This guide covers the structure of chains and rules, allowing and blocking traffic, listing and deleting rules, and making them persist across reboots.

Syntax

The basic syntax of the iptables command is:

iptables [-t TABLE] COMMAND CHAIN RULE

Common Options and Parameters

The most useful options and parameters for the iptables command:

Practical Examples

Real iptables commands you can run today:

# List all rules with packet counts
sudo iptables -L -n -v
# Allow incoming SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow HTTP and HTTPS
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
# Block a specific IP
sudo iptables -A INPUT -s 203.0.113.5 -j DROP
# Delete a rule by number
sudo iptables -D INPUT 3
# Save rules (Debian/Ubuntu)
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Tips and Best Practices

• Allow SSH before setting a restrictive default policy on a remote server, or you will lock yourself out.
• iptables rules are not persistent by default — save them with iptables-save and restore with iptables-restore, or use the iptables-persistent package.
• For most host firewalling, ufw is far simpler and sits on top of iptables; reach for raw iptables when you need fine control or NAT.

Final Thoughts

iptables gives complete control over the Linux firewall through ordered rules in chains, at the cost of complexity. Learn to list with -L -n -v, append with -A, and the ACCEPT/DROP actions, and always allow SSH before tightening defaults. Save rules so they survive reboots — and remember ufw handles the common cases with far less effort.