iptables Basics: Rules, Chains and Saving

This guide is for learning. Run these commands only on your own lab or servers.

iptables filters packets using rules grouped in chains. INPUT handles traffic coming to the machine, OUTPUT traffic leaving it and FORWARD traffic passing through.

1. See what exists

sudo iptables -L -n -v

2. Allow established traffic and SSH first

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

3. Drop the rest

sudo iptables -P INPUT DROP

4. Save the rules

sudo apt install iptables-persistent
sudo netfilter-persistent save

Add the SSH rule before you set the DROP policy. Test on a lab virtual machine first.