How to set up a basic firewall with iptables in Linux

To configure the iptables firewall, first set the default policy, deny all inbound and forwarded traffic, and allow outbound traffic; 2. Then allow local loopback and established connection traffic; 3. Then open necessary service ports such as SSH, HTTP, HTTPS, etc.; 4. Optional configuration logs to record discarded packets; 5. Finally, save the rules to prevent restart loss, ensuring system security and not interrupting normal access.

Setting up a basic firewall with iptables in Linux helps protect your system by controlling incoming and outgoing network traffic. Here's how to configure a simple but effective firewall using iptables rules.

1. Understanding iptables Basics

iptables is a user-space utility program that allows you to configure the IP packet filter rules of the Linux kernel firewall. It works with chains: INPUT (incoming traffic), OUTPUT (outgoing traffic), and FORWARD (routed traffic).

By default, most systems have no restrictive rules, meaning all traffic is allowed. The goal is to set policies that deny unwanted traffic while allowing essential services.

2. Set Default Policies

Start by setting default policies to drop all incoming and forwarded traffic, while allowing outgoing traffic. Run these commands as root or with sudo:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

This means only responses to your outgoing connections will be allowed in unless explicitly permitted.

3. Allow Loopback and Established Connections

You need to allow loopback traffic (used by local services) and traffic that belongs to existing connections:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

The first rule allows all traffic on the loopback interface. The second permits responses to connections initiated from your machine.

4.Allow Essential Services

Open ports for services you use. For example, to allow SSH (port 22), HTTP (80), and HTTPS (443):

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Adjust these based on what you need. If you're running a web server, keep 80 and 443 open. For remote access via SSH, ensure port 22 is accessible.

5. Optional: Log Dropped Packets

To help with troubleshooting, log packets that get dropped:

iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: "
iptables -A INPUT -j DROP

This logs dropped packets to /var/log/kern.log or /var/log/messages , depending on your system.

6. Save the Rules

Rules are lost after reboot unless saved. On Debian/Ubuntu:

iptables-save > /etc/iptables/rules.v4

On CentOS/RHEL, use:

service iptables save

Or manually save with:

iptables-save > /etc/iptables/rules.conf

And restore at boot with iptables-restore .

Basically, this setup gives you a secure baseline. You can expand it as needed for other ports or protocols. Just remember to test connectivity after applying rules so you don't lock yourself out.

The above is the detailed content of How to set up a basic firewall with iptables in Linux. For more information, please follow other related articles on the PHP Chinese website!