⚡ 100% In-Browser & Private: Your data never leaves your computer. Powered by Cloudflare Edge CDN.
ProWebTools PRO
Developer & SEO Utilities
25+ Rules

Iptables & Netfilter Firewall Commands Cheat Sheet

Production Linux Netfilter / iptables firewall command matrix covering chains, port allow/drop rules, rate limiting, NAT masquerade, and persistent rule management with 1-click copy.

Inspection & Listing (4 commands)

Inspection & Listing
sudo iptables -L -n -v

List all active rules across standard chains with numeric IP addresses, ports, and packet/byte counters.

PRO TIP The -n flag prevents slow reverse DNS lookups, displaying immediate numeric outputs.
Inspection & Listing
sudo iptables -L INPUT -n -v --line-numbers

Lists incoming (INPUT) rules with sequential index numbers needed for precise rule deletion.

PRO TIP Identify exact line numbers to run iptables -D INPUT safely.
Inspection & Listing
sudo iptables -t nat -L -n -v

Inspects rules in the Network Address Translation (NAT) table, including PREROUTING and POSTROUTING.

PRO TIP Essential for auditing Docker port forwards, Kubernetes NodePorts, and VPN gateways.
Inspection & Listing
sudo iptables -Z

Zeroes all packet and byte counters across all chains to monitor new network traffic bursts.

PRO TIP Run prior to stress tests or attack simulations to isolate fresh traffic flows.

Filtering & Hardening (6 commands)

Filtering & Hardening
sudo iptables -P INPUT DROP

Sets default inbound traffic policy to DROP all packets unless explicitly permitted by subsequent rules.

PRO TIP Fundamental security baseline: deny all incoming connections by default.
Filtering & Hardening
sudo iptables -P FORWARD DROP

Sets default forwarding traffic policy to DROP, preventing unauthorized packet routing through server.

PRO TIP Prevent your server from being utilized as an open network relay or transit route.
Filtering & Hardening
sudo iptables -A INPUT -i lo -j ACCEPT

Allows all local loopback traffic (127.0.0.1) essential for local IPC, database connections, and daemons.

PRO TIP Always add loopback rule before dropping input traffic to avoid breaking local services.
Filtering & Hardening
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allows established and related responses to existing outbound connections (DNS lookups, web downloads).

PRO TIP Stateful firewall rule: ensures return traffic for initiated outbound connections is accepted.
Filtering & Hardening
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Allows incoming SSH management connections on TCP port 22.

PRO TIP Ensure SSH rule is active BEFORE setting default INPUT policy to DROP to prevent lockout.
Filtering & Hardening
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

Allows incoming HTTP (80) and HTTPS (443) web traffic in a single atomic multiport rule.

PRO TIP Combining ports into multiport reduces packet inspection overhead on high-traffic web servers.

Security & Anti-DDoS (5 commands)

Security & Anti-DDoS
sudo iptables -A INPUT -s 198.51.100.42 -j DROP

Instantly blocks all incoming network packets originating from specific attacker IP address.

PRO TIP Drops packets silently without sending ICMP destination unreachable responses.
Security & Anti-DDoS
sudo iptables -A INPUT -s 203.0.113.0/24 -j DROP

Blocks entire CIDR /24 subnet (256 addresses) from accessing any service on this server.

PRO TIP Ideal for mitigating coordinated botnet sweeps originating from specific network blocks.
Security & Anti-DDoS
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set

Tracks new SSH connection attempts per source IP address in recent memory table.

PRO TIP Step 1 of dynamic SSH brute-force protection pipeline.
Security & Anti-DDoS
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

Drops SSH connection attempts if source IP exceeds 4 new connection requests within 60 seconds.

PRO TIP Neutralizes dictionary attacks and automated SSH credential spraying tools.
Security & Anti-DDoS
sudo iptables -A INPUT -p tcp --syn -m limit --limit 2/s --limit-burst 6 -j ACCEPT

Mitigates TCP SYN flood attacks by rate limiting new SYN packets to 2 per second with 6 burst.

PRO TIP Excess SYN packets above the burst threshold are queued or dropped.

NAT & Port Forwarding (5 commands)

NAT & Port Forwarding
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

Transparently redirects incoming traffic on standard port 80 to unprivileged backend service on 8080.

PRO TIP Run Node.js, Python, or Go apps without requiring root port 80 binding privileges.
NAT & Port Forwarding
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Enables dynamic NAT IP masquerading on WAN interface eth0 for internal VPN or container subnets.

PRO TIP Requires sysctl net.ipv4.ip_forward=1 enabled in /etc/sysctl.conf.
NAT & Port Forwarding
sudo iptables -D INPUT 3

Deletes specific rule at line number 3 in the INPUT chain identified via --line-numbers.

PRO TIP Always verify line numbers immediately before deleting, as indices shift after deletion.
NAT & Port Forwarding
sudo iptables -F && sudo iptables -X

Flushes all existing rules and deletes all custom user chains. Resets firewall to defaults.

PRO TIP Caution: if default policy is DROP, flushing rules will immediately lock out remote SSH!
NAT & Port Forwarding
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Saves current runtime firewall configuration to persistent disk file reloaded on system boot.

PRO TIP Requires iptables-persistent or netfilter-persistent package installed on Debian/Ubuntu.