iptables Configuration & Security
This guide explains how to implement a secure default-deny firewall strategy using iptables on your Linux server — all traffic is blocked unless explicitly allowed.
Order is critical! Applying the final DROP policy before allowing SSH access will immediately lock you out of your server. Always test rules carefully and keep a console connection available via the PowerPanel as a fallback.
1. Base Rules in the Correct Order
Configure all necessary access rules before applying the global block policy.
Step 1: Flush Existing Rules
Start with a clean slate by removing all existing iptables rules:
Step 2: Allow Loopback Traffic
Allow all internal traffic on the loopback interface — essential for local services:
Step 3: Allow Established Connections
Allow packets belonging to already-established connections — required so responses to outgoing requests (e.g. DNS, updates) can reach the server:
Step 4: Allow SSH Access
Allow SSH before setting the DROP policy — otherwise you will lock yourself out immediately:
Step 5: Set Default Policy to DROP
Only now — after all allow rules are in place — set the global block policy. Any packet not matched by a previous rule will be dropped:
2. Opening Ports for Services
Add rules for all services that need to be reachable from outside. Using a custom chain keeps the INPUT chain clean and maintainable:
Custom Chain for Open Ports
Create a dedicated chain for open ports and jump to it from INPUT:
HTTP & HTTPS (Web Server)
Restrict Database Access to Specific IPs
Critical ports like database ports should only be opened for known, trusted IP addresses:
Allow ICMP (Ping)
Optional — allows inbound and outbound ping requests for reachability checks:
3. Protection Mechanisms & Logging
Add basic flood protection and logging for dropped packets:
SYN Flood Protection (Rate Limit)
Limits the rate of new connections per source IP to mitigate simple flood attacks:
Drop Invalid Packets (Anti-Scan)
Blocks packets typically used for port scans and specific attack vectors:
Log Dropped Packets
Insert these rules directly before the final DROP policy — with a rate limit to prevent log flooding:
4. Save & Verify Rules
iptables rules are temporary and will be lost after a reboot. They must be saved persistently.
Verify Current Rules
Save Persistently — Debian / Ubuntu
Install iptables-persistent — it automatically loads rules on every reboot:
Save Persistently — CentOS / RHEL
Alternative — nftables: On modern distributions (Debian 10+, Ubuntu 20.04+, RHEL 8+), iptables is being replaced by nftables. For new server deployments, we recommend nftables — it is faster, more readable, and actively maintained. View the nftables guide →
Further Documentation
For a complete reference of all iptables options, refer to the official documentation.