Mastering iptables: Essential Firewall Tables, Chains, and Commands

iptables Basics

iptables is the Linux firewall tool that organizes rules into tables, chains, and individual rules.

Location of Configuration

Edit the configuration file with vim /usr/sysconfig/iptables.

Service Control

Use the following commands to manage the iptables service:

service iptables stop

service iptables start

service iptables restart

service iptables save

Structure

iptables → tables → chains → rules.

Tables and Their Built‑in Chains

Filter Table

The default table with three built‑in chains:

INPUT – handles incoming traffic.

OUTPUT – handles outgoing traffic.

FORWARD – forwards traffic to other interfaces.

NAT Table

Provides three built‑in chains for network address translation:

PREROUTING – processes packets before routing, used for DNAT.

POSTROUTING – processes packets after routing, used for SNAT.

OUTPUT – processes locally generated packets.

Mangle Table

Used to alter packet headers; contains five built‑in chains:

PREROUTING

OUTPUT

FORWARD

INPUT

POSTROUTING

Raw Table

Handles packets before connection tracking; has two built‑in chains:

PREROUTING

OUTPUT

Rules

A rule consists of a condition and a target. If the condition matches, the target action is applied; otherwise the next rule is evaluated.

Common Targets

ACCEPT – allow the packet.

DROP – discard the packet.

QUEUE – hand the packet to userspace.

RETURN – stop processing the current chain and return to the calling chain.

Useful Commands

iptables -t filter -L

– list rules in the filter table. iptables -t nat -L – list rules in the NAT table. iptables -t mangle -L – list rules in the mangle table. iptables -t raw -L – list rules in the raw table. iptables --flush – delete all rules.

Example Output

Sample listing of the INPUT chain shows rule numbers, targets, protocols, source and destination addresses, and optional match criteria.