iptables and nftables: manual firewall rules on Linux

Write iptables/nftables rules for default-drop, port forwarding, and rate limiting when UFW is too limited.

Server SecurityAdvanced

Why

UFW can't express per-IP rate limits, port forwarding (DNAT), or custom chains for Docker. iptables/nftables give full control; nftables is the modern replacement with a cleaner syntax and atomic rule swaps. Verizon's 2024 DBIR shows 68% of breaches involve a non-malicious human element.

SSH key compromise and misconfigured S3 buckets are top attack vectors — hardening reduces breach risk by 80%+.

When

Use when UFW can't express the rule (rate limit, DNAT, Docker interaction), or on distros without UFW (RHEL, Alpine). Avoid security theater (obscurity without depth) — a non-standard SSH port stops 0 real attacks.

Skip heavy WAF rules if you have no known vulnerabilities; they add latency and false positives.

How

1. Set default policies: `iptables -P INPUT DROP`, `iptables -P FORWARD DROP`, `iptables -P OUTPUT ACCEPT`. 2. Allow established: `iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`. 3. Allow loopback: `iptables -A INPUT -i lo -j ACCEPT`. 4. Allow SSH with rate limit: `iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH` then `iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP` then ACCEPT. 5. Save: `iptables-save > /etc/iptables/rules.v4`. 6. For nftables, write a /etc/nftables.conf and `nft -f` it.

Example

# Default drop, allow established + loopback + SSH (rate-limited) + web iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT # SSH rate limit: 4 new conns/min per source iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT # Persist apt install iptables-persistent netfilter-persistent save

Common Problems

⚠Setting INPUT DROP before allowing established/SSH locks you out — order matters, allow first.
⚠Forgetting to persist with iptables-persistent loses all rules on reboot — install the package and save.
⚠Docker's DOCKER chain bypasses INPUT; rules on INPUT don't affect container traffic — use DOCKER-USER instead.

Best Practices

✓Prefer nftables on new systems (Debian 10+, RHEL 8+) — atomic rule swaps, cleaner syntax, better performance.
✓Always allow established/related and loopback before setting DROP policy, or you lock yourself out.
✓Use iptables-persistent (Debian) or firewalld (RHEL) so rules survive reboot; test with a reboot in staging.

FAQ

What is iptables and nftables: manual firewall rules on Linux and what problem does it solve?

Write iptables/nftables rules for default-drop, port forwarding, and rate limiting when UFW is too limited. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with iptables and nftables: manual firewall rules on Linux in 5 minutes?

Two steps to run it: (1) Set default policies: `iptables -P INPUT DROP`, `iptables -P FORWARD DROP`, `iptables -P OUTPUT ACCEPT`.; (2) Allow established: `iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with iptables and nftables: manual firewall rules on Linux?

The most frequent issue is: Setting INPUT DROP before allowing established/SSH locks you out — order matters, allow first.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for iptables and nftables: manual firewall rules on Linux?

Best practices for iptables and nftables: manual firewall rules on Linux include: Prefer nftables on new systems (Debian 10+, RHEL 8+) — atomic rule swaps, cleaner syntax, better performance.; Always allow established/related and loopback before setting DROP policy, or you lock yourself out.; Use iptables-persistent (Debian) or firewalld (RHEL) so rules survive reboot; test with a reboot in staging.. The first one — "Prefer nftables on new systems (Debian 10+, RHEL 8+) — atomic rule swaps, cleaner syntax, better performance." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with iptables and nftables: manual firewall rules on Linux?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most iptables and nftables: manual firewall rules on Linux options offer a free tier — validate within free quota before scaling.