Contents
- 1 Linux iptables Basic Examples
- 1.1 Block everything firewall
- 1.2 Allow everything firewall
- 1.3 Minimal emergency firewall
- 1.4 A practical, simple iptables firewall init.d script
- 1.5 Funny story
- 2 Load firewall on boot
- 2.1 RedHat
- 2.2 Ubuntu/Debian
- 3 Traffic shaping
- 4 Handy commands
- 4.1 Ban -- block an annoying machine
- 4.2 Show packet and byte counts
Linux iptables Basic Examples
The following are simple iptables firewalls for Linux. I use these as starter firewalls when I setup a machine. I don't like using iptables-restore. I prefer to simply script the iptables commands that I would type at the command line.Most of these scripts start by reinitializing iptables, so you will loose any rules, chains, or accounting information that iptables knows about. For example, this deletes any policies, chains, and rules in place.
iptables -P INPUT ACCEPT # open up default policy on built-in chain iptables -P OUTPUT ACCEPT # open up default policy on built-in chain iptables -P FORWARD ACCEPT # open up default policy on built-in chain iptables -F # delete all rules from all chains iptables -X # delete all user chains (non built-in chains)
Block everything firewall
This blocks everything. You will only be able to access the machine from the console. Don't do this if you are working remotely because your connection will instantly be dropped. Another way to do this would be to disable the network interface. The advantage of blocking everything with iptables instead of shutting down a network interface is that this leaves the kernel network layer still running. Applications will not complain about the network being unavailable. This also blocks all network interfaces at once, so if you have a machine with multiple interfaces this will take care of them all.#!/bin/sh iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -F iptables -X iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP
