Debian VPS<\/a>, run the following commands:<\/p>\napt-get update \r\napt-get upgrade\r\napt-get install iptables iptables-persistent<\/pre>\nIf there is CentOS or Fedora installed on your VPS, run the following commands:<\/p>\n
yum clean all\r\nyum update\r\nyum install iptables<\/pre>\nThat’s it, now you should have successfully installed iptables on your server.<\/p>\n
<\/span>Common firewall rules in iptables<\/span><\/h2>\nListed below are examples about common firewall rules. \nAccept all ESTABLISHED and RELATED packets:<\/p>\n
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<\/pre>\nAllow HTTP and HTTPS connections from anywhere:<\/p>\n
iptables -A INPUT -p tcp --dport 80 -j ACCEPT\r\niptables -A INPUT -p tcp --dport 443 -j ACCEPT<\/pre>\nAllow access on port 21 from a specific IP address only (e.g. 192.168.1.111) and block access from all other IPs to the server (e.g. server IP 192.168.1.100) :<\/p>\n
iptables -A INPUT -s 192.168.1.111 -d 192.168.1.100 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT\r\niptables -A INPUT -d 192.168.1.100 -p tcp -m tcp --dport 21 -j DROP\r\niptables-save<\/pre>\nBlock an IP address (e.g. 192.168.1.19):<\/p>\n
iptables -A INPUT -s 192.168.1.19 -j DROP<\/pre>\nBlock an IP range and reject all packets (e.g. 192.168.1.0\/24):<\/p>\n
iptables -A INPUT -s 192.168.1.0\/24 -j REJECT<\/pre>\nTo block outgoing traffic to a port, (e.g. port 123), use:<\/p>\n
iptables -A OUTPUT -p tcp --dport 123 -j DROP<\/pre>\n<\/span>Common iptables commands<\/span><\/h2>\nList all rules in all chains in verbose mode and display the IP addresses and port numbers instead host names and services, including the interface name, the rule options (if any), and the TOS masks:<\/p>\n
iptables -nvL | less<\/pre>\nChain INPUT (policy ACCEPT 17M packets, 3161M bytes)\r\n pkts bytes target prot opt in out source destination\r\n 90M 18G cP-Firewall-1-INPUT all -- * * 0.0.0.0\/0 0.0.0.0\/0\r\n\r\nChain FORWARD (policy ACCEPT 0 packets, 0 bytes)\r\n pkts bytes target prot opt in out source destination\r\n 0 0 cP-Firewall-1-INPUT all -- * * 0.0.0.0\/0 0.0.0.0\/0\r\n\r\nChain OUTPUT (policy ACCEPT 16M packets, 5107M bytes)\r\n pkts bytes target prot opt in out source destination\r\n 0 0 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 multiport dports 25,465,587 owner GID match 32006\r\n18618 9100K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 multiport dports 25,465,587 owner GID match 12\r\n 0 0 ACCEPT tcp -- * * 0.0.0.0\/0 127.0.0.1 multiport dports 25,465,587 owner UID match 32001\r\n10686 946K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 multiport dports 25,465,587 owner UID match 0\r\n\r\nChain cP-Firewall-1-INPUT (2 references)\r\n pkts bytes target prot opt in out source destination\r\n 39 2264 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:993\r\n 54 2872 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:53\r\n 7509 450K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:21\r\n 557K 34M ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:443\r\n19655 1142K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:80\r\n 1057 43388 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:8080\r\n 7533 452K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:143\r\n 382 16664 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:22\r\n2871K 173M ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:995\r\n23539 1284K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:110\r\n 8353 500K ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:25\r\n 71 3680 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:465\r\n 519K 31M ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW tcp dpt:3306\r\n 132 9948 ACCEPT udp -- * * 0.0.0.0\/0 0.0.0.0\/0 state NEW udp dpt:53\r\n<\/pre>\nTo display rules in chains with rule numbers, use:<\/p>\n
iptables -nvL --line-numbers<\/pre>\nThis is useful if you want to delete a rule (e.g. delete rule number 9 from the INPUT chain):<\/p>\n
iptables -D INPUT 9<\/pre>\nOr, add a rule between two existing rules (e.g. add a firewall rule between rules number 2 and 3):<\/p>\n
iptables -I OUTPUT 3 -d 127.0.0.1\/32 -p tcp -m multiport --dports 25,465,587 -m owner --uid-owner 201 -j ACCEPT<\/pre>\nIn order to list all commands that were used to create the currently used iptables rules, use the following command:<\/p>\n
iptables -S<\/pre>\nThis command is useful if you need to edit or delete some firewall rules.<\/p>\n
-P INPUT ACCEPT\r\n-P FORWARD ACCEPT\r\n-P OUTPUT ACCEPT\r\n-N cP-Firewall-1-INPUT\r\n-A INPUT -j cP-Firewall-1-INPUT\r\n-A FORWARD -j cP-Firewall-1-INPUT\r\n-A OUTPUT -p tcp -m multiport --dports 25,465,587 -m owner --gid-owner mailman -j ACCEPT\r\n-A OUTPUT -p tcp -m multiport --dports 25,465,587 -m owner --gid-owner mail -j ACCEPT\r\n-A OUTPUT -d 127.0.0.1\/32 -p tcp -m multiport --dports 25,465,587 -m owner --uid-owner cpanel -j ACCEPT\r\n-A OUTPUT -p tcp -m multiport --dports 25,465,587 -m owner --uid-owner root -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT\r\n-A cP-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT\r\n<\/pre>\nClear all firewall rules:<\/p>\n
iptables -F<\/pre>\nUse ‘iptables -h | less’ for more information on all iptables command options.<\/p>\n
\n Of course, you don\u2019t have to install iptables and create firewall rules on your VPS, if you use one of our VPS Hosting<\/a> solutions, in which case you can simply ask our expert Linux admins to install iptables and configure firewall rules on your VPS. They are available 24\u00d77 and will take care of your request immediately.<\/p>\nPS<\/strong><\/span>. If you liked this post about common firewall rules and commands in iptables, please share it with your friends on the social networks using the buttons on the left or simply leave a reply below. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":"Today we are going to show you some common firewall rules and commands in iptables. Iptables is a useful command … <\/p>\n
Read More<\/a><\/p>\n","protected":false},"author":4,"featured_media":27129,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1703],"tags":[147,281],"yoast_head":"\nCommon Firewall Rules and Commands in iptables - RoseHosting<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n \n \n\t \n\t \n\t \n