Overview
Iptables is a rule-based firewall, which will process each rule in order until it finds one that matches.
Todo: include example here
Usage
The iptables utility is typically pre-installed on your linux distribution, but isn’t actually running any rules. You’ll find the utility here on most distributions:
Blocking a Single IP Address
You can block an IP by using the -s parameter, replacing 10.10.10.10 with the address that you are trying to block. You’ll note in this example that we used the -I parameter (or –insert works too) instead of the append, because we want to make sure this rule shows up first, before any allow rules.
Allowing All Traffic from an IP Address
You can alternately allow all traffic from an IP address by using the same command as above, but replacing DROP with ACCEPT. You need to make sure that this rule appears first, before any DROP rules.
Blocking a Port From All Addresses
You can block a port entirely from being accessed over the network by using the the –dport switch and adding the port of the service you want to block. In this example, we’ll block the mysql port:
Allowing a Single Port from a Single IP
You can add the -s command along with the –dport command to further limit the rule to a specific port:
Viewing the Current Rules
You can view the current rules using the following command:
This should give you an output similar to the following:
The actual output will be a bit longer, of course.
Clearing the Current Rules
You can clear out all the current rules by using the flush parameter. This is very useful if you need to put the rules in the correct order, or when you are testing.
Distribution-Specific
While most Linux distributions include a form of iptables, some of them also include wrappers which make the management a little easier. Most often these “addons” take the form of init scripts which take care of initializing iptables on startup, though some distributions also include full-blown wrapper applications which attempt to simplify the common case.
Gentoo
The iptables init script on Gentoo is capable of handling many common scenarios. For starters, it allows you to configure iptables to load on startup (usually what you want):
Using the init script, it is possible to load and clear the firewall with an easy-to-remember command:
The init script handles the details of persisting your current firewall configuration on start/stop. Thus, your firewall is always in the state you left it. If you need to manually save a new rule, the init script can handle this as well:
Additionally, you can restore your firewall to the previous saved state (for the case where you were experimenting with rules and now want to restore the previous working configuration):
Finally, the init script can put iptables into a “panic” mode, where all incoming and outgoing traffic is blocked. I’m not sure why this mode is useful, but all Linux firewalls seem to have it.
Warning: Don’t initiate the panic mode if you are connected to your server via SSH; you will be disconnected! The only time you should put iptables into panic mode is while you are physically in front of the computer.
