Serious Discussion Linux Firewall Basics: A Beginner's Guide to iptables for Blocking Common Attacks

[Divergent]

*Please Note: iptables is a powerful firewall tool for Linux systems. Misconfiguring it can lock you out of your server or prevent essential services from working. Always have a backup plan (like console access or a rescue environment) before making significant changes. This guide is for beginners, but even so, proceed with caution and test thoroughly. A full read-through is highly recommended before you start.

If you're running a Linux machine, especially a server, iptables is your go-to tool for managing network traffic. It acts as a strict bouncer, deciding which connections are allowed in, out, and through your system. For beginners, the most secure approach is to block everything by default and then explicitly allow only what's necessary. This is known as the "default deny" or "whitelist" policy.

Understanding iptables Chains and Policies​

iptables works with "chains" of rules. The most common chains you'll interact with are:

• INPUT: For packets coming into your system.
• OUTPUT: For packets originating from your system.
• FORWARD: For packets that are just passing through your system (if it's acting as a router).

Each chain has a default policy (e.g., ACCEPT or DROP). Our goal is to set these policies to DROP (block silently) and then add specific rules to ACCEPT (allow) the traffic we want.

---

Step-by-Step iptables Configuration​

Always run these commands with root privileges (using sudo or as the root user).

1. Flush Existing Rules (Clean Slate)​

Before we start, it's a good idea to clear any old or default rules that might be in place.

Bash

sudo iptables -F # Flush all rules from all chains
sudo iptables -X # Delete all non-default chains
sudo iptables -t nat -F # Flush NAT table rules (if you're doing NAT)
sudo iptables -t nat -X # Delete non-default NAT chains
sudo iptables -t mangle -F # Flush MANGLE table rules
sudo iptables -t mangle -X # Delete non-default MANGLE chains

2. Set Default Policies to DROP (The Secure Foundation)​

This is the most critical step. It tells iptables to block everything by default. Be extremely careful when running these commands, especially if you're connected via SSH, as you might lose connection if you don't immediately add rules to allow SSH back in.

Bash

sudo iptables -P INPUT DROP # Block all incoming traffic by default
sudo iptables -P FORWARD DROP # Block all forwarded traffic by default
sudo iptables -P OUTPUT DROP # Block all outgoing traffic by default

​

3. Allow Loopback Traffic (Essential for Your System)​

The loopback interface (lo or 127.0.0.1) is how your computer talks to itself. Many applications rely on this, so it's vital to allow it.

Bash

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

​

4. Allow Established and Related Connections​

This is crucial for allowing responses to your outgoing connections (like getting a webpage back after you request it). It uses connection tracking (-m state).

Bash

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

​

5. Allow Essential Outgoing Connections (Whitelist What You Need)​

Now, we add rules for what your system needs to do.

• DNS (Domain Name System - Port 53 UDP/TCP): For resolving domain names to IP addresses (e.g., converting https://www.google.com/search?q=google.com to an IP address).
  Bash
  
  sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
  sudo iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
  
  (Note: The ESTABLISHED,RELATED rule from step 4 handles the incoming DNS responses.)
• HTTP (Web Browse - Port 80 TCP) and HTTPS (Secure Web Browse - Port 443 TCP): For accessing websites.
  Bash
  
  sudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
  sudo iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
  
  
• NTP (Network Time Protocol - Port 123 UDP): For synchronizing your system's clock.
  Bash
  
  sudo iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
  
  
• Outgoing Mail (SMTP/SMTPS - Ports 25, 587 TCP): If your system needs to send emails.
  Bash
  
  sudo iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
  sudo iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT
  
  (You might also need to allow POP3/IMAP if you're fetching mail: ports 110, 995, 143, 993 TCP for inbound.)
• Package Manager Updates: Your system needs to download software updates. This typically uses HTTP/HTTPS, so the rules above should cover it. If you use ftp, you might need to add:
  Bash
  
  sudo iptables -A OUTPUT -p tcp --dport 20 -j ACCEPT # FTP Data
  sudo iptables -A OUTPUT -p tcp --dport 21 -j ACCEPT # FTP Control

​

6. Allow Specific Incoming Connections (If Your System is a Server)​

Only allow what is absolutely necessary for your system to function as a server.

• SSH (Secure Shell - Port 22 TCP): If you need to remotely access your Linux machine. This is critical if you're connected via SSH!
  Bash
  
  sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
  
  Highly Recommended: Limit SSH access to specific IP addresses. Replace YOUR_TRUSTED_IP with your home or office IP address.
  Bash
  
  sudo iptables -A INPUT -p tcp -s YOUR_TRUSTED_IP --dport 22 -j ACCEPT
  
  You can also add specific IPs on separate lines.
• Web Server (HTTP/HTTPS - Ports 80, 443 TCP): If your Linux machine is hosting a website.
  Bash
  
  sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
  
  
• Ping (ICMP Echo Request/Reply):Allowing your system to respond to pings can be useful for diagnostics, but it can also be used by attackers for reconnaissance. You can choose to allow or block it.
  • Allow (diagnostic):
    Bash
    
    sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
    sudo iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
    
    
  • Block (more secure, but harder to diagnose if the system is "up"): (This is implicitly blocked by the DROP policy if no other rule allows it).

​

7. Block Common Attack Ports (Explicitly, for Emphasis)​

While your default DROP policy already handles most of these, explicitly blocking known attack vectors can be a good practice or for clarity.

• Telnet (Port 23 TCP): Insecure, unencrypted remote access. Always use SSH.
  Bash
  
  sudo iptables -A INPUT -p tcp --dport 23 -j DROP
  
  
• FTP (Ports 20, 21 TCP): Insecure file transfer. Use SFTP or SCP instead.
  Bash
  
  sudo iptables -A INPUT -p tcp --dport 20 -j DROP
  sudo iptables -A INPUT -p tcp --dport 21 -j DROP
  
  
• RDP (Remote Desktop Protocol - Port 3389 TCP): Common target for brute-force attacks. Block if not using (usually for Windows, but Linux RDP servers exist).
  Bash
  
  sudo iptables -A INPUT -p tcp --dport 3389 -j DROP
  
  
• SMB/NetBIOS (Ports 137, 138, 139 UDP/TCP, 445 TCP): File sharing, often targeted for malware (e.g., WannaCry). Block if not needed.
  Bash
  
  sudo iptables -A INPUT -p udp --dport 137 -j DROP
  sudo iptables -A INPUT -p udp --dport 138 -j DROP
  sudo iptables -A INPUT -p tcp --dport 139 -j DROP
  sudo iptables -A INPUT -p tcp --dport 445 -j DROP
  
  
• SQL Databases (e.g., MySQL 3306 TCP, MS-SQL 1433/1434 TCP): Block if your system isn't a database server or if access should be internal only.
  Bash
  
  sudo iptables -A INPUT -p tcp --dport 3306 -j DROP
  sudo iptables -A INPUT -p tcp --dport 1433 -j DROP
  sudo iptables -A INPUT -p tcp --dport 1434 -j DROP

8. Save Your iptables Rules​

iptables rules are temporary and will be lost on reboot unless saved. The method to save rules depends on your Linux distribution.

• For Debian/Ubuntu (using iptables-persistent package):
  1. Install the package: sudo apt install iptables-persistent
  2. During installation, it will ask to save current rules. Say Yes.
  3. To manually save later:
     Bash
     
     sudo iptables-save > /etc/iptables/rules.v4
     sudo ip6tables-save > /etc/iptables/rules.v6
     
• For RHEL/CentOS (using iptables service):
  1. Save rules: sudo service iptables save or sudo /sbin/iptables-save > /etc/sysconfig/iptables
  2. Enable the service to start on boot: sudo systemctl enable iptables
• Generic (less common for persistent rules, but useful for quick saves):
  Bash
  
  sudo iptables-save > /path/to/your/custom/rules.sh
  
  Then, you'd need to create a script to load these rules on boot. This is more advanced.

​

9. Verify Your Rules​

Always check your rules after making changes:

Bash

sudo iptables -L -n -v

• -L: List rules
• -n: Show IP addresses and port numbers (numeric output) instead of hostnames and service names, which is faster.
• -v: Verbose output, showing packet counts and interface details.

---

Key Principles for Firewall Security​

• Default Deny: Block everything that isn't explicitly allowed. This is the strongest security posture.
• Principle of Least Privilege: Only open ports and allow traffic that is absolutely necessary for your system's function.
• Specificity: Be as specific as possible with your rules. If a service only needs to communicate with a certain IP address, restrict it to that IP.
• Logging: iptables can log dropped packets. This is invaluable for troubleshooting and detecting attacks. (More advanced topic, but iptables -A INPUT -j LOG before the final DROP can start this.)
• Regular Review: Periodically review your firewall rules to ensure they are still relevant and secure.
• Stay Updated: Keep your Linux distribution and all software updated. Patches often fix security vulnerabilities.
• Combine with Other Security: iptables is a network firewall. It should be part of a broader security strategy including strong passwords, SSH keys, intrusion detection systems, and regular backups.

---

Remember to proceed with caution! A misconfigured firewall can lead to unexpected outages. If you get locked out, you might need to use console access to fix your rules or revert to a backup. Good luck securing your Linux system!

 

[Bot]

This is a comprehensive guide for beginners on how to use iptables, a powerful firewall tool for Linux systems. It covers everything from understanding iptables chains and policies, to configuring iptables, blocking common attack ports, and saving your iptables rules. It also provides key principles for firewall security. Remember, misconfiguring iptables can lead to unexpected outages, so always have a backup plan and proceed with caution.