iptables/nftables — Firewall Rule Management

Q: What is the difference between iptables and nftables?

nftables is the modern replacement for iptables, offering a cleaner syntax (single tool replacing iptables/ip6tables/ebtables/arptables), better performance, and atomic rule replacement. iptables remains widely used and is pre-installed on many distributions. Use nftables for new projects but keep iptables knowledge for maintaining legacy systems.

Q: What are default policies in iptables and how do I change them?

Default policies are typically INPUT ACCEPT, FORWARD ACCEPT, OUTPUT ACCEPT. Change them with iptables -P INPUT DROP. A common best-practice is setting INPUT default to DROP, then explicitly allowing needed ports. Always ensure SSH is already allowed before changing the default policy, or you'll immediately lose connectivity.

Q: What is the difference between MASQUERADE and SNAT?

MASQUERADE is a special form of SNAT that automatically uses the outgoing interface's IP address, making it ideal for dynamic IPs (PPPoE, DHCP). SNAT requires specifying a fixed source address and is suitable for static IPs. Both are used in the POSTROUTING chain. MASQUERADE has slightly higher overhead because it queries the IP on each packet.

Q: How do I make iptables rules persistent across reboots?

Save rules with iptables-save > /etc/iptables/rules.v4, then install iptables-persistent or netfilter-persistent package, or create a systemd service that runs iptables-restore /etc/nftables.conf and enable the nftables service.

Q: What are ESTABLISHED and RELATED connection states used for?

ESTABLISHED matches bidirectional connections already confirmed, while RELATED matches child connections associated with an existing connection (e.g., FTP data connections, ICMP errors). Example: iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. This lets you only allow NEW inbound connections on specific ports while return traffic flows automatically.

iptables is the traditional management tool for the Linux kernel netfilter firewall, while nftables is its modern replacement. This cheatsheet covers core operations for both: rule CRUD, NAT configuration, port forwarding, rule persistence, and advanced matching (rate limiting, string matching, connection tracking).

Updated: 2026-07-17·33 commands

Overview

iptables is the user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall. This cheatsheet covers basic rules, NAT, forwarding, and persistence.

Quick Start

``bash iptables -L -v -n # List current rules iptables -P INPUT DROP # Set default policy iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Allow SSH``

Refer to the command table below for detailed usage.

Basic Rules(19)

Command	Level	Example
`iptables -L -v -n --line-numbers` List all rules with details, line numbers, and no DNS resolution	Basic	`iptables -L INPUT -v -n --line-numbers`
`iptables -A` Append a rule to the end of a chain	Basic	`iptables -A INPUT -p tcp --dport 22 -j ACCEPT`
`iptables -I` Insert a rule at the beginning or a specific position	Basic	`iptables -I INPUT 2 -p tcp --dport 443 -j ACCEPT`
`iptables -D` Delete a specific rule	Basic	`iptables -D INPUT 3`
`iptables -F` Flush all rules from a specific chain	Basic	`iptables -F INPUT`
`iptables -P` Set the default policy for a chain	Basic	`iptables -P INPUT DROP`
`iptables -p` Match protocol (tcp/udp/icmp/all)	Basic	`iptables -A INPUT -p udp --dport 53 -j ACCEPT`
`iptables --dport` Match destination port	Basic	`iptables -A INPUT -p tcp --dport 80 -j ACCEPT`
`iptables -s` Match source IP address	Basic	`iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT`
`iptables -j ACCEPT` Allow matching packets through	Basic	`iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT`
`iptables -j DROP` Silently drop matching packets	Basic	`iptables -A INPUT -s 203.0.113.0/24 -j DROP`
`iptables -j REJECT` Reject matching packets with an error response	Intermediate	`iptables -A INPUT -p tcp --dport 23 -j REJECT --reject-with tcp-reset`
`ip6tables` IPv6 firewall rule management	Intermediate	`ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT`
`nft list ruleset` List the entire nftables ruleset	Intermediate	`nft list ruleset`
`nft add rule` Add a rule to an nftables chain	Intermediate	`nft add rule inet filter input tcp dport 22 accept`
`nft add table` Create an nftables table	Intermediate	`nft add table inet my_table`
`nft add chain` Create an nftables chain	Expert	`nft add chain inet my_table my_chain { type filter hook input priority 0\; }`
`nft delete rule` Delete an nftables rule	Intermediate	`nft delete rule inet filter input handle 3`
`nft flush ruleset` Flush all nftables rules	Intermediate	`nft flush ruleset`

Advanced(6)

Command	Level	Example
`iptables -j LOG` Log matching packets to syslog without blocking	Intermediate	`iptables -A INPUT -p tcp --dport 22 -j LOG --log-prefix "SSH_ATTEMPT: "`
`iptables -m state --state` Match by connection state (legacy state module)	Intermediate	`iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT`
`iptables -m conntrack --ctstate` Match by connection tracking state (recommended)	Intermediate	`iptables -A INPUT -m conntrack --ctstate NEW -p tcp --dport 80 -j ACCEPT`
`iptables -m limit` Rate limiting match (prevents DOS/brute force)	Expert	`iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min --limit-burst 5 -j ACCEPT`
`iptables -m recent` Dynamic match based on recent connection history	Expert	`iptables -A INPUT -p tcp --dport 22 -m recent --name SSH --rcheck --seconds 60 -j DROP`
`iptables -m string --string --algo` Match by packet payload (string filtering)	Expert	`iptables -A FORWARD -m string --string "BitTorrent" --algo bm -j DROP`

NAT(5)

Command	Level	Example
`iptables -t nat -A PREROUTING` Add a DNAT rule in the NAT table PREROUTING chain	Intermediate	`iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.5:8080`
`iptables -t nat -A POSTROUTING` Add a SNAT/MASQUERADE rule in the NAT table POSTROUTING chain	Intermediate	`iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE`
`iptables -t nat -A PREROUTING -j DNAT` Destination NAT (port forwarding)	Intermediate	`iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443`
`iptables -t nat -A POSTROUTING -j SNAT` Source NAT (fixed egress IP)	Intermediate	`iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 203.0.113.10`
`iptables -t nat -A POSTROUTING -j MASQUERADE` Source masquerade (dynamic egress IP)	Intermediate	`iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE`

Forwarding(1)

Command	Level	Example
`iptables -t filter -A FORWARD` Add a forwarding control rule in the filter table FORWARD chain	Intermediate	`iptables -A FORWARD -i eth0 -o eth1 -m conntrack --ctstate NEW -j ACCEPT`

Persistence(2)

Command	Level	Example
`iptables-save` Export current iptables rules to stdout	Intermediate	`iptables-save > /etc/iptables/rules.v4`
`iptables-restore` Restore iptables rules from file (atomic operation)	Intermediate	`iptables-restore < /etc/iptables/rules.v4`

FAQ

What is the difference between iptables and nftables?

What are default policies in iptables and how do I change them?

What is the difference between MASQUERADE and SNAT?

How do I make iptables rules persistent across reboots?

What are ESTABLISHED and RELATED connection states used for?

This cheatsheet is compiled from official tool documentation. Last updated: 2026-07-17.