Mastering iptables: A Beginner’s Guide to Linux Firewall Configuration

Introduction

In early Linux systems the default firewall was iptables. Although firewalld has been available for years, many enterprises still use iptables in production, so a thorough explanation remains valuable.

What is iptables?

iptables is a user‑space tool that manages the netfilter/iptables packet‑filtering subsystem in the Linux kernel, allowing administrators to set, maintain, and inspect IP packet filtering rules.

Features

iptables works in kernel space and provides three built‑in tables— filter, nat, and mangle. Rules become effective immediately without restarting services.

iptables Architecture

iptables is organized into tables, each containing chains, which in turn contain rules. When writing rules you first select a table, then a chain.

Note: the raw table handles exceptional processing and is rarely needed.

Overall, iptables is built from “three tables and five chains”.

Three tables

filter

– packet filtering; chains: INPUT, OUTPUT,

FORWARD

nat

– network address translation; chains: PREROUTING, POSTROUTING,

OUTPUT

mangle

– packet alteration and traffic shaping; chains: INPUT, OUTPUT, FORWARD, POSTROUTING,

PREROUTING

Priority: mangle > nat > filter

Five built‑in chains

INPUT

– packets destined for the local host OUTPUT – locally generated packets (usually not filtered) FORWARD – packets routed through the host PREROUTING – packets before routing, used for DNAT POSTROUTING – packets after routing, used for SNAT

Packet processing flow

Incoming packets first traverse the PREROUTING chain, where the kernel decides whether to forward them.

If a packet is addressed to the host, it moves to the INPUT chain and is delivered to local processes.

Locally generated packets pass through OUTPUT and then POSTROUTING before leaving.

Forwarded packets go through FORWARD and then POSTROUTING before exiting.

Summary: packets are either destined for the firewall itself or need to be forwarded through it.

Installation

1. Stop firewalld

systemctl stop firewalld
systemctl disable firewalld

2. Install iptables

yum -y install iptables-services

3. Start the service

systemctl start iptables
systemctl enable iptables

4. Configuration file location

ll /etc/sysconfig/iptables

Example configuration:

The article covers the basics of iptables; future sections will dive into syntax details and real‑world use cases.