~/iptables for Network Safety Practices

Sep 16, 2021

iptables is a command-line utility for configuring Linux netfilter firewall policies. It controls the packet filtering and NAT rules of the Linux kernel, enabling administrators to enhance network safety.

Role in Network Security

iptables is frequently used to set up firewall rules that restrict unauthorized network access, filter traffic by IP address, port, or protocol, and log packet data for analysis.

Basic Concepts

Chains
Rules are organized in chains like INPUT, OUTPUT, and FORWARD. Each chain is traversed based on packet direction.

Tables
iptables uses tables like filter, nat, and mangle for different rule classes.

Targets
Common targets are ACCEPT, DROP, and REJECT.

Fundamental Safety Practices

1. Default Policy
   Set restrictive default policies to DROP unwanted packets.

1
2
3

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

2. Allow Trusted Traffic
   Explicitly allow SSH and loopback connections for administration and local applications.

1
2

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

See SSH best practices.

3. Stateful Filtering
   Allow established or related connections.

1

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Refer to connection tracking for details.

4. Logging
   Log dropped packets for monitoring suspicious activity.

1

iptables -A INPUT -j LOG --log-prefix "iptables dropped: "

See syslog configuration.

5. Restrict Ports and Services
   Only open necessary ports; drop or reject all others.

1
2

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Hardening Tips

• Protect against SYN floods by limiting new connections.

1

iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT

• Block ping floods.

1

iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

• Protect against spoofed IP addresses.

Advanced Topics

• Use ipset for large rule sets.
• Combine with fail2ban for dynamic blocking.
• Prefer nftables on newer systems for better performance and flexibility.

Troubleshooting

• List rules with iptables -L -v -n.
• Test with nmap.
• Use tcpdump to verify traffic flow.

Conclusion

iptables is a core security tool for Linux, providing stateful packet inspection, NAT, and traffic filtering. Correctly configured iptables rules are a strong foundation for network safety. Many resources elaborate on firewall best practices and netfilter recommendations.