iptables - NexonHost.com

How to use iptables The user-space application program iptables allows configuring the tables provided by the Linux kernel firewall, as well as the chains and rules it stores. The kernel module currently used for iptables only applies to IPv4 traffic, to configure firewall rules for IPv6 connections instead use ip6tables, which respond to the same command structures as iptables. If you are using CentOS 7, you should look into configuring firewalld, which combines the functionality of iptables and ip6table, though it’s possible to still use iptables just the same. Listing current rules On CentOS and other Red Hat variants, iptables often comes with some pre-configured rules, check the current iptable rules using the following command. sudo iptables -L This will print out a list of three chains, input, forward and output, like the empty rules table example output below. Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination The chain names indicate which traffic the rules in each list will be applied to, input is for any connections coming to your cloud server, output is any leaving traffic and forward for any pass through. Each chain also has its policy setting which determines how the traffic is handled if it doesn’t match any specific rules, by default it’s set to accept. Adding rules Firewalls can commonly be configured in one of two ways, either set the default rule to accept and then block any unwanted traffic with specific rules, or by using the rules to define allowed traffic and blocking everything else. The latter is often the recommended approach, as it allows pre-emptively blocking traffic, rather than having to reactively reject connections that should not be attempting to access your cloud server. To begin using iptables, you should first add the rules for allowed inbound traffic for the services you require. Iptables can track the state of the connection, so use the command below to allow established connections continue. sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT You can check that the rule was added using the same sudo iptables -L as before. Next, allow traffic to a specific port to enable SSH connections with the following. sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT The ssh in the command translates to the port number 22, which the protocol uses by default. The same command structure can be used to allow traffic to other ports as well. To enable access to an HTTP web server, use the following command. sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT After adding all the allowed rules you require, change the input policy to drop. Warning: Changing the default rule to drop will permit only specifically accepted connection. Make sure you’ve enabled at least SSH as shown above before changing the default rule. sudo iptables -P INPUT DROP The same policy rules can be defined to other chains as well by entering the chain name and selecting either DROP or ACCEPT. Saving and restoring rules Now if you were to restart your cloud server all of these iptables configurations would be wiped. To prevent this, save the rules to a file. sudo iptables-save > /etc/sysconfig/iptables You can then simply restore the saved rules by reading the file you saved. # Overwrite the current rules sudo iptables-restore < /etc/sysconfig/iptables # Add the new rules keeping the current ones sudo iptables-restore -n < /etc/sysconfig/iptables To automate the restore at reboot CentOS offers a system service by the same name, iptables. However, it does not come in the default configuration and needs to be installed manually. sudo yum install iptables-services Once installed, start and enable the service. sudo systemctl start iptables sudo systemctl enable iptables Afterwards, you can simply save the current rules using the following command. sudo service iptables save These are just a few simple commands you can use with iptables, which is capable of much more. Read on to check on some of the other options available for more advanced control over iptable rules.

Bare Metal

Servers

Storage

Virtual Servers

Linux VPS

Unmetered Linux VPS

Windows VPS

Unmetered Windows VPS

Storage VPS

OpenClaw Hosting

Remote Protection

Website DDoS Protection

Remote DDoS Protection License

Colocation

Server Colocation

Management

Infrastructure Management

Cloud Hosting

Magento Pro Hosting

OpenCart Hosting

Reseller Pro Hosting

PrestaShop Hosting

WordPress Pro Hosting

Web Hosting

Netherlands

Romania

Germany

Tag Archives: iptables

Recent Posts

Categories

Follow us

Our Products

Dedicated Servers

Compare us with Competitors

Quick Links

Newsletter