$ sudo iptables -L -v -n Chain INPUT (policy DROP 2 packets, 92 bytes) List all firewall rules to verify that executed commands are applied as desired. Iptables -A OUTPUT -j chain-outgoing-services Iptables -A INPUT -p tcp -dport 22 -j chain-incoming-ssh # Accept incoming/outgoing packets for established connections Iptables -A INPUT -m conntrack -ctstate INVALID -j DROP Iptables -A chain-states -p icmp -m conntrack -ctstate ESTABLISHED,RELATED -j ACCEPT Iptables -A chain-states -p udp -m conntrack -ctstate ESTABLISHED,RELATED -j ACCEPT Iptables -A chain-states -p tcp -m conntrack -ctstate ESTABLISHED,RELATED -j ACCEPT # Define chain to allow established connections Iptables -A chain-outgoing-services -j DROP

Iptables -A chain-outgoing-services -p icmp -j ACCEPT Iptables -A chain-outgoing-services -p tcp -dport 22 -j ACCEPT Iptables -A chain-outgoing-services -p tcp -dport 443 -j ACCEPT Iptables -A chain-outgoing-services -p tcp -dport 80 -j ACCEPT Iptables -A chain-outgoing-services -p udp -dport 123 -j ACCEPT Iptables -A chain-outgoing-services -p tcp -dport 123 -j ACCEPT Iptables -A chain-outgoing-services -p udp -dport 53 -j ACCEPT Iptables -A chain-outgoing-services -p tcp -dport 53 -j ACCEPT # Define chain to allow particular services Iptables -A chain-incoming-ssh -s 192.168.1.149 -j ACCEPT Iptables -A chain-incoming-ssh -s 192.168.1.148 -j ACCEPT # Define chain to allow particular source addresses Create an iptables firewall using custom chains that will be used to control incoming and outgoing traffic.Ĭreate an iptables firewall that will allow already established connections, incoming ssh for given source addresses, outgoing icmp, ntp, dns, ssh, http, and https.

Iptables chains