$_shellschool
…

iptables

Linux · Network · reference only

What it does

Configures the kernel's packet filtering rules: what traffic comes in, goes out or is forwarded. It is the base of many Linux firewalls.

Syntax

iptables [-t tabla] orden cadena [reglas] -j acción

Options and parameters

  • -L

    Lists the rules of one chain or of all.

  • -n

    Shows numeric addresses and ports, without resolving names.

  • -A cadena

    Appends a rule to the end of the chain.

  • -D cadena

    Removes a rule, by its number or its text.

  • -F

    Flushes all the rules of the chain or of all.

  • -P cadena acción

    Changes a chain's default policy.

  • -t tabla

    Chooses the table: filter, nat, mangle or raw.

  • -j acción

    What to do with the packet: ACCEPT, DROP, REJECT, LOG...

Usage examples

  • sudo iptables -L -n

    Shows all rules with numbers.

  • sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

    Allows incoming connections to port 22.

  • sudo iptables -D INPUT 3

    Removes rule number 3 from the INPUT chain.

  • sudo iptables -S

    Shows the rules in the format they would be written.

Notes and common mistakes

  • A wrong command can lock you out: e.g. -P INPUT DROP without a rule allowing SSH.
  • Rules are lost on reboot unless you save them with iptables-persistent or another tool.
  • On Debian 12 iptables uses the nftables backend underneath.

Related commands