Configuring Linux Firewall

Last Updated : 11 May, 2026

A Linux firewall is a critical security layer that monitors and controls network traffic, protecting your system from unauthorized access and potential threats. By defining rules, it ensures only legitimate traffic passes while blocking harmful connections. Linux provides tools like iptables and firewalld to effectively manage and secure network communications.

  • Acts as a barrier between internal networks and external connections.
  • Filters incoming and outgoing traffic based on predefined rules.
  • Restricts unauthorized access and prevents data breaches.
  • Supports both software and hardware based implementations.
  • Ensures legitimate communication without compromising security.

Working of Linux Firewall

A Linux firewall monitors network traffic by inspecting each packet that enters or leaves the system. It applies predefined rules to decide whether the traffic should be allowed, blocked, or redirected, ensuring that only legitimate connections pass through while protecting the system from unauthorized access and attacks. The packet filtering process follows these steps:

  • Packet Arrival: A packet enters the system from an external network or is generated internally.
  • Rule Evaluation: The firewall checks the packet against its rules, considering the IP address (source or destination), port number (like 80 for HTTP, 22 for SSH), protocol (TCP, UDP, ICMP, etc.), and connection state (new or established).
  • Decision Making: The firewall decides the packet’s handling, if it matches an allow rule, it passes or if it matches a deny rule, it is blocked.
  • Traffic Forwarding: Allowed packets are delivered to their destination, while blocked packets are discarded or recorded in a log.

Note: Running firewall commands usually requires sudo privileges.

Method 1: Configuring Firewall with iptables

iptables is a powerful Linux utility for managing network traffic. It allows system administrators to filter packets, block unwanted connections, and define custom security rules. This method is best suited for advanced users or those managing complex networks.

How iptables Works

iptables operates using a three-tier structure

1. Tables

Tables are logical groupings of chains in iptables. Each table is designed for a specific type of packet processing, which allows precise control over network traffic. There are four commonly used tables:

  • Filter (default table): Handles general packet filtering like blocking or allowing traffic. It contains the default chains INPUT, OUTPUT, and FORWARD.
  • NAT (Network Address Translation): Changes packet source or destination addresses for port forwarding, masquerading, or mapping internal to public IPs. Its default chains are PREROUTING, POSTROUTING, and OUTPUT.
  • Mangle: Performs advanced packet modifications, such as changing the Type of Service (TOS), Time To Live (TTL), or Quality of Service (QoS). Its chains include PREROUTING, POSTROUTING, INPUT, OUTPUT, and FORWARD.
  • Raw: Pre-processes packets before connection tracking. This is useful to bypass tracking for certain packets from being tracked. Its chains are PREROUTING and OUTPUT.

2. Chains

Chains are ordered sequences of rules within a table. Each chain processes packets in a specific direction or scenario. In the filter table, there are three default chains:

  • INPUT: Handles packets destined for the local machine, such as SSH connections from a remote system.
  • OUTPUT: Handles packets originating from the local machine, for example, HTTP requests sent to external servers.
  • FORWARD: Handles packets passing through the system that are not intended for local delivery, such as traffic routed through a Linux server acting as a gateway.

3. Rules

Rules are the instructions in iptables that determine how packets should be handled. Each rule contains conditions (criteria) and an action (target). Common actions include:

  • ACCEPT: Allows the packet to continue to its destination. For example, permitting SSH traffic on port 22.
  • DROP: Silently discards the packet without sending a response. This is commonly used to block all traffic from a malicious IP.
  • REJECT: Blocks the packet and sends an error message to the sender, useful when you want the sender to know the traffic is denied.
  • LOG: Records packet details in system logs for monitoring or troubleshooting. For example, logging unauthorized connection attempts.
  • JUMP: Redirects the packet to another chain, which can be built-in or user-defined, allowing for modular rule organization.

Note: Rules are evaluated from top to bottom in a chain. Once a packet matches a rule, the corresponding action is applied, and remaining rules are skipped. Proper ordering is crucial; for instance, an ACCEPT rule must come before a DROP rule for the same IP or port, otherwise the packet may be blocked prematurely.

Step 1: Check Current Rules

Before modifying your firewall, it’s important to see the rules currently in place. Most Linux systems start with no predefined rules, but checking ensures you know the current state.

Command:

sudo iptables -L
  • -L : Lists all rules in each chain.

Output:

  • Target: Action applied to matching packets (ACCEPT, DROP, REJECT).
  • Prot: Protocol used (TCP, UDP, ICMP, etc.).
  • Source: IP address where the packet originates.
  • Destination: IP address where the packet is going.
  • Packets/Bytes: Counters showing how many packets/bytes matched the rule.

Step 2: Clear Existing Rules

Before creating new rules, it’s best to flush existing ones to avoid conflicts. This step resets the chains to a clean state.

Command:

sudo iptables -F
  • -F : Flushes all rules from all chains, removing them completely.

Step 3: Set Default Policies

Default policies define what happens to packets that do not match any rule in a chain. Setting strict defaults ensures unrecognized traffic is handled safely.

Command:

sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT
  • -P <CHAIN> <POLICY>: Sets the default policy for the chain.
  • INPUT DROP: Blocks all incoming traffic by default.
  • FORWARD DROP: Blocks forwarded packets by default.
  • OUTPUT ACCEPT: Allows outgoing traffic from the system.

Step 4: Allow Essential Traffic (ACCEPT Rule)

To allow essential traffic (such as SSH) while blocking others, you must explicitly accept packets before DROP rules. This ensures important traffic is processed first.

Syntax:

sudo iptables [-A | -I] <chain_name> -s <source_ip> -p <protocol_name> --dport <port_number> -j <target_action>
  • -A <chain_name>: Append the rule to the end of the specified chain (INPUT, OUTPUT, FORWARD).
  • -I <chain_name>: Insert the rule at the beginning of the specified chain.
  • -s <source_ip>: Matches packets originating from this IP address.
  • -p <protocol_name>: Specifies the protocol to match (like tcp, udp).
  • --dport <port_number>: Specifies the destination port. This is valid only with -p <protocol_name>.