Iptables Command: A Guide to Firewall Configuration on Ubuntu Router

Understanding Iptables Basics

The iptables utility is a command-line firewall configuration tool for Linux systems. It operates by organizing rules into tables, with the filter table being the default. Within these tables, packets are processed through chains of rules in a specific order. The three primary built-in chains are INPUT, which handles packets destined for the local system; OUTPUT, for packets originating from the local system; and FORWARD, for packets passing through the system from one interface to another.

When configuring an Ubuntu router, understanding these chains is critical because misconfigured rules can block legitimate traffic or expose internal networks to external threats. Each rule specifies a target action, such as ACCEPT, DROP, or REJECT. By default, if no rule matches a packet, the chain's default policy determines the outcome. It is standard practice to set the default policy of INPUT and FORWARD chains to DROP to ensure a deny-by-default security posture.

Initial Setup and Verification

Before applying new rules, it is essential to verify the current state of the firewall. You can view existing rules using the iptables -L -n -v command. This displays detailed information about each rule, including the number of packets matched and bytes transferred. If you are setting up a new router, you will likely see empty chains with ACCEPT policies, which indicates that all traffic is currently allowed.

To begin securing your router, first establish a baseline by allowing loopback traffic. Loopback interfaces are used for inter-process communication on the same machine and should always be permitted. Use the following command to accept all traffic on the loopback interface:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

This step ensures that local applications can communicate without interference. After adding this rule, verify its presence in the list to confirm it was added correctly. Failure to allow loopback traffic can cause unexpected behavior in many system services.

Configuring Core Firewall Rules

For a router, the most important chain to configure is the FORWARD chain, as it controls traffic passing between network interfaces. Start by accepting established and related connections. This allows return traffic for connections initiated by internal clients. Use the state module to identify these packets efficiently:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Next, define which external traffic is allowed to enter your internal network. For example, if you want to allow SSH access from a specific subnet, specify the source IP range and the destination port. Always restrict access to management ports to trusted networks only. Additionally, consider enabling NAT (Network Address Translation) if your router connects multiple private subnets to the public internet. While iptables can handle basic NAT, tools like ufw or nftables may offer simpler syntax for complex setups.

If you encounter issues with packet dropping after implementing these rules, refer to our guide on Troubleshooting Dropping Packets in iptables: tcpdump Analysis and Solutions. This resource provides diagnostic steps using tcpdump to identify where packets are being discarded.

Persisting Changes Across Reboots

A common pitfall for Ubuntu administrators is losing firewall rules after a system reboot. By default, iptables rules stored in memory are volatile. To persist them, you must save the current configuration and restore it during boot. On Ubuntu, the netfilter-persistent service handles this task.

First, install the necessary package if it is not already present:

sudo apt-get install netfilter-persistent

Once installed, save your current rules using the following command:

sudo netfilter-persistent save

This command writes the rules to /etc/iptables/rules.v4 for IPv4 and /etc/iptables/rules.v6 for IPv6. During the next boot, the netfilter-persistent service automatically loads these files, ensuring your firewall configuration remains intact. Regularly updating these saved rules is crucial when making changes to your network topology.

Advanced Considerations and Security

While iptables is powerful, it requires careful rule ordering. Rules are evaluated sequentially, so place more specific rules before general ones. For instance, a rule dropping malicious IPs should come before a rule accepting all traffic on a specific port. Additionally, monitor your logs for dropped packets to detect potential attacks. Enable logging by adding a rule with the --log-prefix option before the DROP target.

If your router also hosts containerized applications, be aware that Docker modifies iptables rules automatically. Unmanaged changes can conflict with your manual configurations. For insights into managing default network access in Docker environments, see Default Network Access to the Docker Host. This helps prevent accidental exposure of container services to the public internet.

Frequently Asked Questions

How do I delete a specific iptables rule?

You can delete a rule by specifying its line number within the chain. First, list the rules with numbers using iptables -L -n --line-numbers. Then, use the -D flag followed by the chain name and the line number, such as iptables -D INPUT 3. This removes the third rule from the INPUT chain immediately.

Why is my SSH connection timing out after applying iptables rules?

This usually happens because the default INPUT policy is set to DROP without an explicit rule allowing SSH traffic. Ensure you have added a rule like iptables -A INPUT -p tcp --dport 22 -j ACCEPT before changing the default policy. Always keep an active session open while testing new rules to avoid locking yourself out.

Can I use iptables to block specific countries?

Yes, but it requires a GeoIP database and matching rules based on source IP ranges. Tools like xt_geoip can be compiled with iptables to facilitate this. However, maintaining accurate GeoIP data is challenging due to dynamic IP allocations, and it may lead to false positives blocking legitimate users.

What is the difference between DROP and REJECT?

DROP silently discards packets without notifying the sender, which makes scanning slower but hides your system's existence. REJECT sends an error message back to the sender, providing immediate feedback. For public-facing services, REJECT is often preferred for better user experience, while DROP is better for stealth against attackers.

How do I restore iptables rules from a backup file?

If you have saved your rules to a text file, you can restore them using the iptables-restore command. Simply pipe the contents of the file into the command: cat /path/to/backup.txt | iptables-restore. This applies all rules defined in the file instantly, replacing the current active configuration.