Now let's say we need to add a rule to allow https traffic (port 443). This is why the order of rules is so important. Any rule after the DROP rule will not be met.

If a request is given that's NOT tcp over the SSH or HTTP ports, then it will reach (and match) the last rule in this chain, which says to drop the traffic. If the server has a web request on port 22 (ssh) or 80 (http), it will match the first or second rule (respectively) which says to accept the traffic. Since these rules are applied in order, we can see how this will work. We can look at our rules so far: $ sudo iptables -LĪCCEPT tcp - anywhere anywhere tcp dpt:sshĪCCEPT tcp - anywhere anywhere tcp dpt:http $ sudo iptables -A INPUT -p tcp -dport 80 -j ACCEPTįinally, let's append a rule to drop any other traffic: $ sudo iptables -A INPUT -j DROP The only thing different we'll do here is set port 80 manually (although we could use 'http' instead of defining '80'). Next, we can allow regular web traffic (port 80). -j ACCEPT - Set it to accept traffic to the input chain when using tcp on the ssh port.-dport ssh - Apply the rule to the port used by SSH (22).-p tcp - Apply the rule to the tcp protocol.-A INPUT - Append a rule to the 'input' chain.This will allow incoming SSH (port 22) traffic: sudo iptables -A INPUT -p tcp -dport ssh -j ACCEPT The first rule that matches the type of traffic will be used. Since each rule in a chain followed in order, it's important that the rules are setup in proper order. You can manage firewall rules in each chain by using the commands to append, insert or remove rules. RedHat/CentOS servers tend to DENY all traffic in each chain by default. Debian/Ubuntu servers tend to come with all chains open to all traffic - set to ACCEPT. You can define a default behaviour for each chain - either to ACCEPT all traffic, or DENY all traffic. FORWARD - rules to determine which traffic to be forwarded will be accepted or denied.OUTPUT - rules to determine which outbound traffic will be accepted or denied.INPUT - rules to determine which inbound traffic will be accepted or denied.

Each chain is a list of rules for packets (traffic) that are followed in order. There are a few things to know about firewall rules with iptables before diving in and creating rules.

This article goes into depth with configuring your iptables firewall. In previous articles I listed how to set up a firewall without getting into any detail. Your firewall is an important first line of defense on any publicly-accessible server.

Ubuntu iptables