Iptables Cheatsheet

iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall.

Installation

iptables is pre-installed on most Linux distributions. To make rules persistent across reboots, install the persistence package.

# Debian / Ubuntu
sudo apt install iptables iptables-persistent
 
# RHEL / CentOS / Fedora
sudo dnf install iptables-services

Viewing Rules

sudo iptables -L                   # List all rules in all chains
sudo iptables -L -v -n             # List rules with packet counts and numeric IPs/ports
sudo iptables -S                   # Print rules in iptables command format (useful for scripting)
sudo iptables -L -t nat            # List rules in the NAT table

Default Policies

Set the default action when no rule matches a packet.

sudo iptables -P INPUT DROP        # Drop all incoming traffic by default
sudo iptables -P FORWARD DROP      # Drop all forwarded traffic by default
sudo iptables -P OUTPUT ACCEPT     # Allow all outgoing traffic by default

Allowing Traffic

# Allow loopback (localhost) — always add this first
sudo iptables -A INPUT -i lo -j ACCEPT
 
# Allow established and related connections (replies to outgoing requests)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
# Allow SSH (port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
 
# Allow HTTP and HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 
# Allow ICMP (ping)
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
 
# Allow from a specific IP address
sudo iptables -A INPUT -s 192.168.1.100 -j ACCEPT
 
# Allow from a subnet
sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Dropping and Blocking

# Drop all traffic from a specific IP
sudo iptables -A INPUT -s 192.168.1.100 -j DROP
 
# Reject traffic (sends an ICMP "port unreachable" response to sender)
sudo iptables -A INPUT -p tcp --dport 23 -j REJECT
 
# Drop traffic on a specific port
sudo iptables -A INPUT -p tcp --dport 23 -j DROP

Deleting Rules

# Delete a rule by its specification (exact match of the rule you added)
sudo iptables -D INPUT -p tcp --dport 23 -j DROP
 
# Delete a rule by line number (use -L --line-numbers first to find it)
sudo iptables -L --line-numbers
sudo iptables -D INPUT 3          # Delete rule number 3 from the INPUT chain

Flushing Rules

sudo iptables -F                   # Flush all rules in all chains (does NOT reset policies)
sudo iptables -X                   # Delete all user-defined chains
sudo iptables -t nat -F            # Flush NAT table rules

NAT and Port Forwarding

# Enable IP forwarding (required for NAT — set in /etc/sysctl.conf for persistence)
sudo sysctl -w net.ipv4.ip_forward=1
 
# Masquerade outgoing traffic (SNAT — used for sharing internet via a gateway)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 
# Port forwarding: redirect incoming traffic on port 8080 to internal server 192.168.1.10:80
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80
sudo iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT

Logging

# Log dropped packets before dropping them (logs appear in /var/log/syslog or journal)
sudo iptables -A INPUT -j LOG --log-prefix "IPT-DROP: " --log-level 4
sudo iptables -A INPUT -j DROP

Saving and Restoring Rules

Rules are lost on reboot unless saved.

# Debian / Ubuntu (with iptables-persistent)
sudo netfilter-persistent save     # Save current rules
sudo netfilter-persistent reload   # Reload saved rules
 
# RHEL / CentOS (with iptables-services)
sudo service iptables save         # Save to /etc/sysconfig/iptables
 
# Manual save and restore (any distro)
sudo iptables-save > /etc/iptables.rules
sudo iptables-restore < /etc/iptables.rules

Cheatsheets