The iptables
application is a firewall essential for securely working with network resources on the Linux platform. While there is extensive material dedicated to configuring iptables, we will focus on a few specific tasks: how to view rule lists, delete unnecessary rules, flush chains, and clear the packet count and byte size counters.
We do not recommend modifying the SSH connection on port 22
unless you are absolutely sure of your actions, as you might accidentally block remote access to your test host.
In this guide, we will use a Hostman cloud server running Ubuntu. The setup process will be similar on CentOS and Debian.
Before proceeding, make sure you have a user with sudo privileges.
In iptables
, you can view the rules set by default or by a previous administrator. Execute the command:
sudo iptables -S
The result will be displayed like this:
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N ICMP
-N TCP
-N UDP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
This function is used when you want to exclude a specific chain (e.g., INPUT
, OUTPUT
, TCP
, etc.) from the general output. Specify the chain name after the -S
option. Example:
sudo iptables -S TCP
The result:
-N TCP
-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
This method is convenient for comparing different rules. The tabular format is built into the utility and is activated using the -L
option. Enter:
sudo iptables -L
You can also limit the output to a specific chain:
sudo iptables -L INPUT
Sample output:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
UDP udp -- anywhere anywhere ctstate NEW
TCP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
ICMP icmp -- anywhere anywhere ctstate NEW
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT all -- anywhere anywhere reject-with icmp-proto-unreachable
Explanation:
target
– action taken when a packet matches the rule (e.g., ACCEPT
, DROP
, redirect to another chain).prot
– protocol used (UDP
, TCP
, ALL
).opt
– IP options, if any.source
– source IP/subnet (e.g., "anywhere" = from anywhere).destination
– destination IP/subnet.You can also display the packet and total byte count per rule. This is useful for estimating traffic by rule. Available with -L
and -v
:
sudo iptables -L INPUT -v
Sample output:
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
284K 42M ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 DROP all -- any any anywhere anywhere ctstate INVALID
396 63275 UDP udp -- any any anywhere anywhere ctstate NEW
17067 1005K TCP tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
2410 154K ICMP icmp -- any any anywhere anywhere ctstate NEW
396 63275 REJECT udp -- any any anywhere anywhere reject-with icmp-port-unreachable
2916 179K REJECT all -- any any anywhere anywhere reject-with icmp-proto-unreachable
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh ctstate NEW,ESTABLISHED
Compare this to previous output and you’ll see two new columns: pkts
and bytes
.
You can reset these counters using the -Z
option. This happens automatically on reboot, but can also be done manually to test for new traffic:
sudo iptables -Z
To reset a specific chain:
sudo iptables -Z OUTPUT
To reset a specific rule in a chain by number:
sudo iptables -Z OUTPUT 2
Use -D
followed by the full rule specification. View existing rules first. For example, to remove the rule that drops invalid outgoing traffic:
sudo iptables -D OUTPUT -m conntrack --ctstate INVALID -j DROP
No need to use -A
when deleting.
Use --line-numbers
to get rule numbers:
sudo iptables -L --line-numbers
Sample output:
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
2 ACCEPT all -- anywhere anywhere
3 DROP all -- anywhere anywhere ctstate INVALID
...
Then delete by number:
sudo iptables -D INPUT 3
Be cautious when flushing chains; you could block your SSH connection.
sudo iptables -F INPUT
sudo iptables -F
This command allows all traffic (inbound, outbound, forwarded), essentially disabling the firewall. If you run it on a production system, you’ll need to reconfigure the firewall from scratch. Always back up your current rules:
iptables-save > iptables_backup.txt
Restore them later with:
iptables-restore < iptables_backup.txt
Before flushing, set the default policy to ACCEPT
to avoid losing SSH access:
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
Then flush everything:
sudo iptables -t nat -F
sudo iptables -t mangle -F
sudo iptables -F
sudo iptables -X
This allows all traffic. If you list rules after this, only the default chains (INPUT
, FORWARD
, OUTPUT
) will be present.
This tutorial provides practical guidance on how to view, reset, and delete iptables firewall rules and perform similar actions on specific chains. Keep in mind that any changes will be lost upon server reboot unless saved.