iptables in Practice — Adding Rules, NAT, and Port Forwarding

Packet received
    ↓
PREROUTING (NAT)
    ↓
Routing decision
    ├── Local process → INPUT → process → OUTPUT → send
    └── Forwarding → FORWARD → POSTROUTING → send

# List current rules
sudo iptables -L -n -v --line-numbers

# List NAT table
sudo iptables -t nat -L -n -v

# Specific chain only
sudo iptables -L INPUT -n -v

# Default DROP (whitelist approach)
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Keep established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (do this first so you don't lock yourself out!)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# HTTP / HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# ICMP (ping)
sudo iptables -A INPUT -p icmp -j ACCEPT

# Block an IP
sudo iptables -A INPUT -s 203.0.113.0/24 -j DROP

# Allow an IP (specific port)
sudo iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 5432 -j ACCEPT

# Delete a blocking rule (by line number)
sudo iptables -L INPUT --line-numbers
sudo iptables -D INPUT 3    # Delete the 3rd rule

# Delete a specific rule
sudo iptables -D INPUT -s 203.0.113.0/24 -j DROP

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Persist: add net.ipv4.ip_forward = 1 to /etc/sysctl.conf

# NAT setup (internet sharing; eth0 is the external interface)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# 80 → internal server 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080
sudo iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 8080 -j ACCEPT

# Local port redirection (3000 → 80, without root)
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 3000

# Ubuntu / Debian
sudo apt install -y iptables-persistent
sudo netfilter-persistent save
sudo netfilter-persistent reload

# CentOS / RHEL
sudo service iptables save
# Saved to: /etc/sysconfig/iptables

# Manual save and restore
sudo iptables-save > /etc/iptables/rules.v4
sudo iptables-restore < /etc/iptables/rules.v4

sudo iptables -F        # Flush all rules
sudo iptables -X        # Delete user-defined chains
sudo iptables -t nat -F
sudo iptables -P INPUT ACCEPT   # Restore policy to ACCEPT