1024 Tool Box/Command Generators/iptables Command Generator

iptables Command Generator

Generate iptables commands to configure Linux netfilter firewall rules (append, delete, list, set policy)

Getting Started with iptables

## What is iptables?

`iptables` configures the netfilter firewall in the Linux kernel. It builds ordered rule lists (chains) that decide what happens to each network packet — accept, drop, reject, log, or return it. Rules live in memory and must be saved explicitly to survive a reboot.

## How to Use

1. **Pick an action**: `append` (`-A`), `insert` (`-I`), `delete` (`-D`), `list` (`-L`), `policy` (`-P`), or `flush` (`-F`). 2. **Choose a chain**: `INPUT`, `OUTPUT`, `FORWARD`, or a custom chain. 3. **Add matches**: protocol (`-p`), destination port (`--dport`), source (`-s`). 4. **Set a target**: `-j ACCEPT|DROP|REJECT|LOG|RETURN`. 5. **Copy & Run** — and **always keep a working SSH session open** before applying rules.

⚠️ **Warning**: A misapplied iptables rule can lock you out of the server over SSH. Test new rules from a second terminal, and never flush the INPUT chain with a default DROP policy unless you have console access.

Common Actions, Matches & Targets

### `-A` / `-I` / `-D` Append, insert, delete `-A CHAIN` adds a rule at the end of a chain; `-I CHAIN [n]` inserts at position n (default 1, highest priority); `-D CHAIN` removes a rule.

### `-L` / `-F` / `-P` List, flush, policy `-L` lists rules; `-F` clears a chain (or all chains); `-P CHAIN TARGET` sets the chain's default policy applied when no rule matches.

### `-p` Protocol match Match `tcp`, `udp`, or `icmp`. Required before `--dport`.

### `--dport` Destination port Match packets destined for a port, e.g. `--dport 22` for SSH. Must follow `-p tcp` or `-p udp`.

### `-s` Source match Match the source IP or CIDR, e.g. `-s 192.168.1.0/24`.

### `-j` Jump to target Decide the packet's fate: `ACCEPT`, `DROP` (silently discard), `REJECT` (discard with ICMP error), `LOG` (log and continue), or `RETURN` (stop processing this chain).

▶How do I make iptables rules persistent across reboots?

Rules are in-memory only. On Debian/Ubuntu run `sudo netfilter-persistent save` (after installing `iptables-persistent`). On RHEL/CentOS run `sudo service iptables save` or `sudo iptables-save > /etc/sysconfig/iptables`. Without one of these, rules vanish on reboot.

▶What is a default policy and why does it matter?

The default policy (`-P`) is applied when no rule in the chain matches. `iptables -P INPUT DROP` drops everything not explicitly allowed — secure but dangerous if you forget to allow SSH first: `iptables -A INPUT -p tcp --dport 22 -j ACCEPT`.

▶How do I open port 80 for a web server?

Append an allow rule: `sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT`. To block a subnet entirely: `sudo iptables -A INPUT -s 203.0.113.0/24 -j DROP`.

If this tool has been helpful to you, consider buying me a coffee.

Buy me a coffee

You might also need

dig Command Generator grep Command Generator tar Command Generator netstat Command Generator systemctl Command Generator sort Command Generator ps Command Generator rsync Command Generator

iptables Command Generator

Getting Started with iptables

Common Actions, Matches & Targets

You might also need

Comments