{"id":12821,"date":"2025-12-13T16:26:37","date_gmt":"2025-12-13T10:56:37","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=12821"},"modified":"2025-12-24T16:14:06","modified_gmt":"2025-12-24T10:44:06","slug":"configure-iptables-on-linux","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/configure-iptables-on-linux","title":{"rendered":"How to Configure IPTables on Linux Server &#8211; (Guide 2026)"},"content":{"rendered":"\n<p>To configure IPTables on a Linux server, define default policies, allow essential traffic (SSH, HTTP\/HTTPS), permit established connections, then drop everything else. Save and persist rules with iptables-save or iptables-persistent (Debian\/Ubuntu) or iptables-services (RHEL\/Alma\/Rocky). Test from a second session to avoid lockouts and log drops for troubleshooting.<\/p>\n\n\n\n<p>Configure IPTables on Linux server is a core skill for secure hosting in 2026. This guide walks you step by step\u2014covering how IPTables works, safe setup, common rules, NAT\/port forwarding, persistence across reboots, and troubleshooting. Whether you\u2019re running a VPS, dedicated server, or cloud instance, you\u2019ll learn a production-ready firewall workflow.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"what-is-iptables-and-how-does-it-work\"><strong>What Is IPTables and How Does It Work?<\/strong><\/h2>\n\n\n\n<p>IPTables is the Linux userspace firewall tool that interfaces with Netfilter in the kernel. It evaluates packets through tables (filter, nat, mangle) and chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING) using rules that match criteria and take actions (ACCEPT, DROP, REJECT). In 2026, many distros use nftables underneath, but iptables-nft compatibility remains widely available.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"quick-overview-best-practice-rule-flow\"><strong>Quick Overview: Best-Practice Rule Flow<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set default policies to DROP.<\/li>\n\n\n\n<li>Allow loopback and established\/related traffic.<\/li>\n\n\n\n<li>Allow SSH (with rate limits) and required service ports (e.g., 80\/443).<\/li>\n\n\n\n<li>Optionally allow ICMP (ping) with limits.<\/li>\n\n\n\n<li>Log drops at a sane rate for visibility.<\/li>\n\n\n\n<li>Persist rules and test thoroughly.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"prerequisites-and-safety-checklist\"><strong>Prerequisites and Safety Checklist<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Root or sudo access on your Linux server.<\/li>\n\n\n\n<li>Two sessions open (e.g., SSH + console) to prevent lockout.<\/li>\n\n\n\n<li>IP of your management machine (to whitelist if needed).<\/li>\n\n\n\n<li>Package availability:\n<ul class=\"wp-block-list\">\n<li>Debian\/Ubuntu: iptables, iptables-persistent or netfilter-persistent<\/li>\n\n\n\n<li>RHEL\/Alma\/Rocky: iptables, iptables-services (optional), firewalld (if you prefer a higher-level tool)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Know whether you\u2019re using iptables-legacy or iptables-nft:\n<ul class=\"wp-block-list\">\n<li>Debian\/Ubuntu: update-alternatives &#8211;config iptables<\/li>\n\n\n\n<li>RHEL 8\/9: iptables is a wrapper to nftables by default; commands still work unless you remove compatibility.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"step-by-step-iptables-configuration-2026\"><strong>Step-by-Step IPTables Configuration (2026)<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"1-inspect-current-rules-and-back-them-up\"><strong>1) Inspect Current Rules and Back Them Up<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo iptables -L -n -v\nsudo iptables-save &gt; ~\/iptables.backup.$(date +%F-%H%M).v4\n# For IPv6 if in use:\nsudo ip6tables -L -n -v\nsudo ip6tables-save &gt; ~\/ip6tables.backup.$(date +%F-%H%M).v6<\/code><\/pre>\n\n\n\n<p>Always keep a backup. If things break, you can restore quickly using iptables-restore.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"2-flush-old-rules-optional-with-caution\"><strong>2) Flush Old Rules (Optional, With Caution)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Clear rules and user-defined chains\nsudo iptables -F\nsudo iptables -X\nsudo iptables -t nat -F\nsudo iptables -t nat -X\nsudo iptables -t mangle -F\nsudo iptables -t mangle -X\n\n# Reset default policies to ACCEPT temporarily while building rules\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT<\/code><\/pre>\n\n\n\n<p>Keep defaults OPEN while you add allow rules. You\u2019ll set them to DROP after whitelisting critical access.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"3-allow-loopback-and-established-related-traffic\"><strong>3) Allow Loopback and Established\/Related Traffic<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Allow loopback\nsudo iptables -A INPUT -i lo -j ACCEPT\nsudo iptables -A OUTPUT -o lo -j ACCEPT\n\n# Allow established\/related\nsudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\nsudo iptables -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n\n\n\n<p>This preserves existing connections and prevents breakage during the change window.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"4-allow-ssh-with-basic-protection\"><strong>4) Allow SSH with Basic Protection<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Optional: restrict SSH to your IP\n# sudo iptables -A INPUT -p tcp -s YOUR.IP.ADDR.HERE --dport 22 -m conntrack --ctstate NEW -j ACCEPT\n\n# Or allow SSH from anywhere with rate-limit\nsudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 10\/min --limit-burst 20 -j ACCEPT<\/code><\/pre>\n\n\n\n<p>Using a rate limit helps slow brute-force attempts. Pair with key-based auth and fail2ban for stronger protection.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"5-allow-web-and-app-ports\"><strong>5) Allow Web and App Ports<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># HTTP\/HTTPS\nsudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT\n\n# Add more services as needed, e.g., MySQL (local only), SMTP, etc.\n# sudo iptables -A INPUT -p tcp -s 127.0.0.1 --dport 3306 -m conntrack --ctstate NEW -j ACCEPT<\/code><\/pre>\n\n\n\n<p>Expose only what you need. For databases, allow localhost or known application subnets only.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"6-optional-allow-icmp-ping-safely\"><strong>6) Optional: Allow ICMP (Ping) Safely<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Allow limited ping to aid monitoring\nsudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5\/second -j ACCEPT<\/code><\/pre>\n\n\n\n<p>Ping helps with diagnostics. If your policy forbids it, skip this step.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"7-log-and-drop-the-rest\"><strong>7) Log and Drop the Rest<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Log (rate-limited) then drop\nsudo iptables -A INPUT -m limit --limit 5\/min -j LOG --log-prefix \"IPT DROP: \" --log-level 7\nsudo iptables -P INPUT DROP\nsudo iptables -P FORWARD DROP\n# Typically OUTPUT stays ACCEPT for servers initiating outbound traffic\nsudo iptables -P OUTPUT ACCEPT<\/code><\/pre>\n\n\n\n<p>Set logging first, then DROP policies. Check \/var\/log\/syslog or \/var\/log\/messages depending on your distro.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"common-iptables-rules-and-examples\"><strong>Common IPTables Rules and Examples<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"whitelist-a-trusted-ip-or-subnet\"><strong>Whitelist a Trusted IP or Subnet<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Allow all from a trusted office IP\nsudo iptables -A INPUT -s 203.0.113.10 -j ACCEPT\n\n# Allow a subnet (CIDR)\nsudo iptables -A INPUT -s 203.0.113.0\/24 -j ACCEPT<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"block-a-malicious-ip\"><strong>Block a Malicious IP<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo iptables -A INPUT -s 198.51.100.22 -j DROP<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"rate-limit-new-connections-to-a-port\"><strong>Rate-Limit New Connections to a Port<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Example: throttle HTTP floods of new TCP connections\nsudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 50\/second --limit-burst 200 -j ACCEPT<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"drop-invalid-packets\"><strong>Drop Invalid Packets<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"nat-and-port-forwarding-dnat-snat\"><strong>NAT and Port Forwarding (DNAT\/SNAT)<\/strong><\/h2>\n\n\n\n<p>If your server acts as a gateway or reverse proxy, you may need NAT rules. Enable IP forwarding first:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo 1 | sudo tee \/proc\/sys\/net\/ipv4\/ip_forward\n# Persist by editing \/etc\/sysctl.conf and setting:\n# net.ipv4.ip_forward = 1\nsudo sysctl -p<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"port-forward-80-to-backend-10-0-0-108080\"><strong>Port Forward 80 to Backend 10.0.0.10:8080<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># DNAT inbound requests hitting eth0\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 \\\n -j DNAT --to-destination 10.0.0.10:8080\n\n# Allow forwarding to backend\nsudo iptables -A FORWARD -p tcp -d 10.0.0.10 --dport 8080 \\\n -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT\n\n# SNAT\/MASQUERADE so replies return via this gateway (dynamic public IP)\nsudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE<\/code><\/pre>\n\n\n\n<p>On servers with static public IPs, prefer SNAT with &#8211;to-source YOUR.PUBLIC.IP for performance and clarity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"persisting-iptables-rules-across-reboots\"><strong>Persisting IPTables Rules Across Reboots<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"debian-ubuntu\"><strong>Debian\/Ubuntu<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install -y iptables-persistent\nsudo netfilter-persistent save\n# Alternatively:\n# sudo sh -c 'iptables-save &gt; \/etc\/iptables\/rules.v4'\n# sudo sh -c 'ip6tables-save &gt; \/etc\/iptables\/rules.v6'<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"rhel-almalinux-rocky-8-9\"><strong>RHEL\/AlmaLinux\/Rocky (8\/9)<\/strong><\/h3>\n\n\n\n<p>These use nftables under the hood. If you insist on iptables persistence, install iptables-services (not always recommended if firewalld is managing nftables):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install -y iptables-services\nsudo systemctl enable --now iptables\nsudo sh -c 'iptables-save &gt; \/etc\/sysconfig\/iptables'\nsudo systemctl restart iptables<\/code><\/pre>\n\n\n\n<p>Alternatively, manage firewall rules with firewalld or native nftables for long-term compatibility, especially on newer releases.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"testing-and-troubleshooting\"><strong>Testing and Troubleshooting<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>List rules in command form: iptables -S<\/li>\n\n\n\n<li>Check counters: iptables -L -n -v<\/li>\n\n\n\n<li>Verify listening services: ss -tulpn<\/li>\n\n\n\n<li>Scan from another host (carefully): nmap -Pn -p 22,80,443 your.server.ip<\/li>\n\n\n\n<li>Watch logs: journalctl -f or tail -f \/var\/log\/syslog<\/li>\n\n\n\n<li>Restore backup if needed:<br><pre class=\"wp-block-code\"><code>sudo iptables-restore &lt; ~\/iptables.backup.DATE.v4<\/code><\/pre><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"iptables-vs-ufw-vs-firewalld-vs-nftables-2026\"><strong>IPTables vs UFW vs firewalld vs nftables (2026)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IPTables: granular, classic tooling; steep learning curve; still supported via iptables-nft on modern kernels.<\/li>\n\n\n\n<li>UFW: user-friendly frontend (Ubuntu); great for simple host firewalls.<\/li>\n\n\n\n<li>firewalld: dynamic daemon with zones; default on RHEL\/Fedora; easier multi-interface policies.<\/li>\n\n\n\n<li>nftables: modern replacement; unified IPv4\/IPv6; simpler syntax and better performance.<\/li>\n<\/ul>\n\n\n\n<p>For new deployments on bleeding-edge distros, nftables or firewalld is future-proof. If your playbooks and teams are standardized on IPTables, the compatibility layer remains reliable in 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"best-practices-for-production-servers\"><strong>Best Practices for Production Servers<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Always add allow rules for SSH and management before setting DROP policies.<\/li>\n\n\n\n<li>Use change windows and keep a console session open (or out-of-band access via your hosting panel).<\/li>\n\n\n\n<li>Apply least privilege: expose only required ports and subnets.<\/li>\n\n\n\n<li>Combine with fail2ban and strong authentication (SSH keys, MFA on control panels).<\/li>\n\n\n\n<li>Document your rule set; use comments with -m comment &#8211;comment &#8220;purpose&#8221;.<\/li>\n\n\n\n<li>Version-control your rules and automate with Ansible or shell scripts.<\/li>\n\n\n\n<li>Review logs for unusual drops; tune rate limits to your traffic profile.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"when-to-consider-managed-firewall-help\"><strong>When to Consider Managed Firewall Help<\/strong><\/h2>\n\n\n\n<p>If you\u2019d rather not babysit firewall syntax, YouStable\u2019s managed VPS and <a href=\"https:\/\/www.youstable.com\/blog\/secure-dedicated-server\/\">dedicated servers<\/a> can ship with hardened firewall profiles, DDoS protection, and 24\u00d77 support. We help you choose the right approach\u2014IPTables, firewalld, or nftables\u2014and keep it compliant with your stack and SLAs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"full-example-minimal-secure-web-server-rules-ipv4\"><strong>Full Example: Minimal, Secure Web Server Rules (IPv4)<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Flush and set permissive defaults while building\niptables -F\niptables -X\niptables -t nat -F\niptables -t mangle -F\niptables -P INPUT ACCEPT\niptables -P FORWARD DROP\niptables -P OUTPUT ACCEPT\n\n# Allow loopback and established\/related\niptables -A INPUT -i lo -j ACCEPT\niptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n\n# SSH with rate-limit\niptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 10\/min --limit-burst 20 -j ACCEPT\n\n# Web traffic\niptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT\niptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT\n\n# Optional: limited ping\niptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5\/second -j ACCEPT\n\n# Drop invalid and log drops\niptables -A INPUT -m conntrack --ctstate INVALID -j DROP\niptables -A INPUT -m limit --limit 5\/min -j LOG --log-prefix \"IPT DROP: \" --log-level 7\n\n# Lock it down\niptables -P INPUT DROP\n\n# Save (Debian\/Ubuntu)\n# netfilter-persistent save\n# Or\n# iptables-save &gt; \/etc\/iptables\/rules.v4<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"faqs-how-to-configure-iptables-on-linux-server\"><strong>FAQs: How to Configure IPTables on Linux Server<\/strong><\/h2>\n\n\n\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"is-iptables-still-used-in-2026-or-should-i-switch-to-nftables\">Is IPTables still used in 2026, or should I switch to nftables?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Yes, IPTables is still used\u2014often via the iptables-nft compatibility layer. For new builds, nftables or firewalld offers cleaner syntax and long-term support. If your tooling relies on IPTables, you can keep using it reliably in 2026.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-do-i-make-iptables-rules-persistent-after-reboot\">How do I make IPTables rules persistent after reboot?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>On Debian\/Ubuntu, install iptables-persistent and run netfilter-persistent save. On RHEL\/Alma\/Rocky, install iptables-services, save rules to \/etc\/sysconfig\/iptables, and enable the iptables service. Verify on reboot with iptables -L -n -v.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"whats-the-safest-way-to-avoid-locking-myself-out\">What\u2019s the safest way to avoid locking myself out?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Keep two sessions open, add SSH allow rules first, apply changes incrementally, and only then set default DROP policies. If available, maintain console or out-of-band access to revert quickly using your hosting control panel.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"should-i-use-ufw-or-firewalld-instead-of-iptables\">Should I use UFW or firewalld instead of IPTables?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>For simplicity, UFW (Ubuntu) and firewalld (RHEL) are easier and integrate well with nftables. IPTables is great for granular control or legacy playbooks. Choose the tool that matches your team\u2019s skills and OS defaults.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-can-i-rate-limit-or-block-ddos-with-iptables\">How can I rate-limit or block DDoS with IPTables?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Use -m limit for new connection rate limits, drop invalid packets, and log suspicious traffic. For volumetric DDoS, host-level IPTables isn\u2019t enough; use upstream protection, CDN\/WAF, and <a href=\"https:\/\/www.youstable.com\/blog\/best-web-hosting-provider-in-india\/\">hosting providers<\/a> like YouStable that offer DDoS mitigation.<\/p>\n\n\n\n<p>With these steps and examples, you now know how to configure IPTables on a Linux server safely and effectively. If you need hardened configurations, staging\/testing help, or 24\u00d77 monitoring, YouStable\u2019s managed hosting can handle the firewall while you focus on your apps.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\n<script type=\"application\/ld+json\">\n\t{\n\t\t\"@context\": \"https:\/\/schema.org\",\n\t\t\"@type\": \"FAQPage\",\n\t\t\"mainEntity\": [\n\t\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Is IPTables still used in 2026, or should I switch to nftables?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Yes, IPTables is still used\u2014often via the iptables-nft compatibility layer. For new builds, nftables or firewalld offers cleaner syntax and long-term support. If your tooling relies on IPTables, you can keep using it reliably in 2026.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How do I make IPTables rules persistent after reboot?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>On Debian\/Ubuntu, install iptables-persistent and run netfilter-persistent save. On RHEL\/Alma\/Rocky, install iptables-services, save rules to \/etc\/sysconfig\/iptables, and enable the iptables service. Verify on reboot with iptables -L -n -v.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"What\u2019s the safest way to avoid locking myself out?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Keep two sessions open, add SSH allow rules first, apply changes incrementally, and only then set default DROP policies. If available, maintain console or out-of-band access to revert quickly using your hosting control panel.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Should I use UFW or firewalld instead of IPTables?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>For simplicity, UFW (Ubuntu) and firewalld (RHEL) are easier and integrate well with nftables. IPTables is great for granular control or legacy playbooks. Choose the tool that matches your team\u2019s skills and OS defaults.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How can I rate-limit or block DDoS with IPTables?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Use -m limit for new connection rate limits, drop invalid packets, and log suspicious traffic. For volumetric DDoS, host-level IPTables isn\u2019t enough; use upstream protection, CDN\/WAF, and <a>hosting providers<\/a> like YouStable that offer DDoS mitigation.<\/p><p>With these steps and examples, you now know how to configure IPTables on a Linux server safely and effectively. If you need hardened configurations, staging\/testing help, or 24\u00d77 monitoring, YouStable\u2019s managed hosting can handle the firewall while you focus on your apps.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t\t\t\t]\n\t}\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>To configure IPTables on a Linux server, define default policies, allow essential traffic (SSH, HTTP\/HTTPS), permit established connections, then drop [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":13028,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[350],"tags":[2156],"class_list":["post-12821","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledgebase","tag-configure-iptables-on-linux"],"acf":[],"featured_image_src":"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/How-to-Configure-IPTables-on-Linux-Server.jpg","author_info":{"display_name":"Prahlad Prajapati","author_link":"https:\/\/www.youstable.com\/blog\/author\/prahladblog"},"_links":{"self":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/comments?post=12821"}],"version-history":[{"count":4,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12821\/revisions"}],"predecessor-version":[{"id":13037,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12821\/revisions\/13037"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media\/13028"}],"wp:attachment":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media?parent=12821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/categories?post=12821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/tags?post=12821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}