{"id":2062,"date":"2021-04-29T01:38:44","date_gmt":"2021-04-29T01:38:44","guid":{"rendered":"https:\/\/dft.wiki\/?p=2062"},"modified":"2026-06-08T22:49:39","modified_gmt":"2026-06-09T02:49:39","slug":"iptables-cheat-sheet","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=2062","title":{"rendered":"IPTables Cheat Sheet"},"content":{"rendered":"<p><strong>IPTables<\/strong> uses the filter table to act as a firewall, but it also controls the routing of packets on Linux.<\/p>\n<p>A table in IPTables is a collection of chains for a particular networking function.<\/p>\n<ul>\n<li><strong>Filter Table<\/strong> (Firewall)\n<ul>\n<li>Input Chain<\/li>\n<li>Output Chain<\/li>\n<li>Forward Chain<\/li>\n<\/ul>\n<\/li>\n<li><strong>NAT Table<\/strong>\n<ul>\n<li>Output Chain<\/li>\n<li>Prerouting Chain<\/li>\n<li>Postrouting Chain<\/li>\n<\/ul>\n<\/li>\n<li><strong>Mangle Table<\/strong>\n<ul>\n<li>Input Chain<\/li>\n<li>Output Chain<\/li>\n<li>Forward Chain<\/li>\n<li>Prerouting Chain<\/li>\n<li>Postrouting Chain<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Chains match packets based on their state. Here is a simplified view of the main chains:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-4730\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/04\/Screenshot-from-2025-02-26-21-32-38-1024x619.png\" alt=\"\" width=\"640\" height=\"387\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/04\/Screenshot-from-2025-02-26-21-32-38-1024x619.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/04\/Screenshot-from-2025-02-26-21-32-38-300x181.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/04\/Screenshot-from-2025-02-26-21-32-38-768x464.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/04\/Screenshot-from-2025-02-26-21-32-38.png 1288w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/p>\n<hr \/>\n<p><strong>COMMANDS<\/strong><\/p>\n<ul>\n<li>iptables <strong>-L<\/strong>\n<ul>\n<li>List rules.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>-L &#8211;line-numbers<\/strong>\n<ul>\n<li>List rules with line numbers.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>-D INPUT<\/strong>\n<ul>\n<li>Delete a rule from the INPUT chain.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>-F<\/strong>\n<ul>\n<li>Flush all rules.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>&#8211;policy INPUT ACCEPT<\/strong>\n<ul>\n<li>Set the default policy to ACCEPT.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>&#8211;policy INPUT DROP<\/strong>\n<ul>\n<li>Set the default policy to DROP.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>-I -s 1.1.1.1 -j ACCEPT<\/strong>\n<ul>\n<li>Insert a rule at the top.<\/li>\n<li>Allows connections from the specified IP.<\/li>\n<\/ul>\n<\/li>\n<li>iptables <strong>-A -s 1.1.1.0\/24 -j DROP<\/strong>\n<ul>\n<li>Append a rule to the end.<\/li>\n<li>Drops connections from the specified network.<\/li>\n<\/ul>\n<\/li>\n<li>iptables -I INPUT <strong>-p tcp &#8211;dport 80<\/strong> -j DROP\n<ul>\n<li>Block incoming connections to a port.<\/li>\n<\/ul>\n<\/li>\n<li>iptables -I <strong>OUTPUT<\/strong> -p tcp &#8211;dport 443 -j DROP\n<ul>\n<li>Drop outgoing packets to a destination port.<\/li>\n<\/ul>\n<\/li>\n<li>sudo iptables -t nat <strong>-L -n -v &#8211;line-numbers<\/strong>\n<ul>\n<li>List all rules in the NAT table with line numbers.<\/li>\n<\/ul>\n<\/li>\n<li>sudo iptables -t nat -D PREROUTING <strong>10<\/strong>\n<ul>\n<li>Delete rule number 10 from the NAT table PREROUTING chain.<\/li>\n<\/ul>\n<\/li>\n<li>iptables -I INPUT -p tcp &#8211;dport -j REJECT <strong>&#8211;reject-with tcp-reset<\/strong>\n<ul>\n<li>Helps prevent port enumeration by sending a TCP reset instead of silently dropping the packet, making scan results less accurate.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Chain traversal for incoming traffic:<\/p>\n<ul>\n<li>PREROUTING -&gt; INPUT\n<ul>\n<li>Inbound traffic destined for the host.<\/li>\n<\/ul>\n<\/li>\n<li>PREROUTING -&gt; FORWARD -&gt; POSTROUTING\n<ul>\n<li>Traffic being routed through the host.<\/li>\n<\/ul>\n<\/li>\n<li>PREROUTING -&gt; OUTPUT -&gt; POSTROUTING\n<ul>\n<li>Outbound traffic originating from the host.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>CREATE PERSISTENCE<\/strong><\/p>\n<pre>sudo \/sbin\/iptables-save | sudo tee \/root\/iptables-rules.v4\r\nsudo apt install iptables-persistent -y<\/pre>\n<p>Alternatively, create the file <code>\/etc\/rc.local<\/code> and add your rules:<\/p>\n<pre>#!\/bin\/bash\r\nsudo iptables -t nat -A PREROUTING -i ens5 -p udp --dport 1144 -j DNAT --to 10.8.0.2:1144\r\nsudo iptables -t nat -A PREROUTING -i ens5 -p tcp --dport 49152:49159 -j DNAT --to 10.8.0.2:49152-49159\r\nexit 0<\/pre>\n<hr \/>\n<p><strong>FLUSHING ALL TABLES AND DELETING ALL CHAINS<\/strong><\/p>\n<pre>sudo iptables -t filter -F\r\nsudo iptables -t filter -X\r\nsudo iptables -t mangle -X\r\nsudo iptables -t mangle -F\r\nsudo iptables -t raw -X\r\nsudo iptables -t raw -F\r\nsudo iptables -t security -X\r\nsudo iptables -t security -F\r\nsudo iptables -t nat -X\r\nsudo iptables -t nat -F<\/pre>\n<hr \/>\n<p><strong>REFLECTIONS<\/strong><\/p>\n<p>Older versions of <strong>UFW<\/strong> only evaluated <strong>INPUT<\/strong> and <strong>OUTPUT<\/strong> chains, but the latest version blocks <strong>FORWARD<\/strong> traffic by default unless manually allowed.<\/p>\n<pre>sudo nano \/etc\/ufw\/before.rules<\/pre>\n<p>Add the following lines before <code>COMMIT<\/code> to allow forwarding to a specific subnet:<\/p>\n<pre>-A FORWARD -d 192.168.10.0\/24 -j ACCEPT\r\n-A FORWARD -s 192.168.10.0\/24 -j ACCEPT<\/pre>\n<p>To allow forwarding of all packets:<\/p>\n<pre>sudo sed -i 's\/^DEFAULT_FORWARD_POLICY=\"DROP\"\/DEFAULT_FORWARD_POLICY=\"ACCEPT\"\/' \/etc\/default\/ufw<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>IPTables uses the filter table to act as a firewall, but it also controls the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2062","post","type-post","status-publish","format-standard","hentry","category-ccna"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2062"}],"version-history":[{"count":10,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2062\/revisions"}],"predecessor-version":[{"id":5733,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2062\/revisions\/5733"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}