Linux command: iptables
Jump to navigation
Jump to search
List current rules
iptables -L List firewall rules
Delete current rules
iptables -F iptables --flush
Save to file
iptables-save > output_iptables_conf_file
Persistent
sudo apt install iptables-persistent
sudo iptables-save | sudo tee /etc/iptables/rules.v4
Collection of basic Linux Firewall iptables rules
Redirect connections to service
#!/bin/bash
# SERVER
sysctl net.ipv4.ip_forward=1
service networking restart
# iptables -t nat -A PREROUTING -p tcp --dport <puerto receptor> -j DNAT --to-destination <ip final>:<puerto de ip final>
# Binance ETH Pool ethash.poolbinance.com
iptables -t nat -A PREROUTING -p tcp --dport 1081 -j DNAT --to-destination 18.193.226.201:1800
# MineXMR Pool pool.minexmr.com
iptables -t nat -A PREROUTING -p tcp --dport 1082 -j DNAT --to-destination 51.68.21.186:4444
iptables -t nat -A PREROUTING -p udp --dport 1082 -j DNAT --to-destination 51.68.21.186:4444
# Masquerade real ip
iptables -t nat -A POSTROUTING -j MASQUERADE
# EJ: iptables -t nat -A PREROUTING -p tcp --dport 110 -j DNAT --to-destination 10.10.0.2:110
# iptables -L -n -t nat
# sudo iptables -L -t nat --line-numbers
sudo iptables -t nat -v -L PREROUTING -n --line-number
# Delete rule
# sudo iptables -t nat -D PREROUTING {rule-number-here}
Block IP
iptables -A INPUT -s IP-ADDRESS -j DROP
Reject all outgoing network connections
iptables -F OUTPUT iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -j REJECT
iptables to reject all incoming network connections
iptables -F INPUT iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -j REJECT
iptables to reject all network connections
iptables -F iptables -A INPUT -j REJECT iptables -A OUTPUT -j REJECT iptables -A FORWARD -j REJECT
iptables to drop incoming ping requests
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
NATing Port redirection
iptables -t nat -A PREROUTING -p udp --destination-port 514 -j REDIRECT --to-ports 1670
Redirectws udp trafic on port 514 to port 1670
iptables to drop outgoing telnet connections
iptables -A OUTPUT -p tcp --dport telnet -j REJECT
iptables to reject incoming telnet connections
iptables -A INPUT -p tcp --dport telnet -j REJECT
iptables to reject outgoing ssh connections
iptables -A OUTPUT -p tcp --dport ssh -j REJECT
iptables to reject incoming ssh connections
iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables to reject all incoming traffic except ssh and local connections
iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT iptables -A INPUT -j REJECT
iptables to accept incoming ssh connections from specific IP address
iptables -A INPUT -p tcp -s 77.66.55.44 --dport ssh -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables to accept incoming ssh connections from specific MAC address
iptables -A INPUT -m mac --mac-source 00:e0:4c:f1:41:6b -p tcp --dport ssh -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables to reject incoming connections on a specific TCP port
iptables -A INPUT -p tcp --dport 3333 -j REJECT
iptables to drop all incoming connections on a specific network interface
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables to create a simple IP Masquerading
The following rule will create a simple IP Masquerading gateway to allow all host on the same subnet to access the Internet.
The below specified eth0 is a external interface connected to the Internet.
echo "1" > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE
Reject all incoming telnet traffic except specified IP address
iptables -A INPUT -t filter ! -s 222.111.111.222 -p tcp --dport 23 -j REJECT
Reject all incoming ssh traffic except specified IP address range
iptables -A INPUT -t filter -m iprange ! --src-range 10.1.1.90-10.1.1.100 -p tcp --dport 22 -j REJECT
Removing negator "!" from the below rule reject all ssh traffic originating from IP address range 10.1.1.90 - 10.1.1.100.
iptables to reject all outgoing traffic to a specific remote host
iptables -A OUTPUT -d 222.111.111.222 -j REJECT
iptables to block an access to a specific website
iptables -A INPUT -s facebook.com -p tcp --sport www -j DROP
Prevent DoS Attack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
Mongo
Allow connections from anywhere
iptables -A INPUT -p tcp --dport 27017 -j ACCEPT
Allow some sources only
iptables -A INPUT -s <ip-address> -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -d <ip-address> -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 192.168.161.200 -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -d 192.168.161.200 -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT
More rules
http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ http://gr8idea.info/os/tutorials/security/iptables8.html