Managing IPTables Firewall on Modern Linux Systems

Date: 16-12-2015

IPTables is a Linux firewall utility used to control network traffic entering and leaving a system. While many modern Linux distributions use Firewalld or nftables by default, IPTables is still commonly used in enterprise environments and appliance deployments.

Important

Changes made directly to IPTables take effect immediately and can impact remote access. Always verify console access or maintain an active SSH session before making firewall changes.

Best Practices

• Back up firewall rules before making changes.
• Use specific source IP restrictions whenever possible.
• Verify services are listening before opening firewall ports.
• Save rules after making modifications.
• Test connectivity after firewall changes.
• Maintain console access when performing firewall maintenance.
• Restrict LDAP and LDAPS access to trusted networks whenever possible.

Check IPTables Service Status

Display the current IPTables service status:

sudo systemctl status iptables

Common service commands:

sudo systemctl start iptables
sudo systemctl stop iptables
sudo systemctl restart iptables
sudo systemctl enable iptables
sudo systemctl disable iptables

View Current Firewall Rules

Display all active rules:

sudo iptables -L -n -v

Display rules in save format:

sudo iptables-save

Backup Existing Rules

Before making changes, create a backup:

sudo iptables-save > /root/iptables.backup

Verify the backup:

cat /root/iptables.backup

Restore Firewall Rules

Restore a previously saved configuration:

sudo iptables-restore < /root/iptables.backup

Reset IPTables Rules

Flush all active rules:

sudo iptables --flush

or

sudo iptables -F

Warning: This immediately removes all active rules and may expose the system to network traffic.

Display the current rules after flushing:

sudo iptables -L -n -v

Save Firewall Changes

After modifying rules, save the current configuration:

sudo iptables-save > /etc/sysconfig/iptables

Restart the service:

sudo systemctl restart iptables

Open a TCP Port

Example: Open TCP port 389 (LDAP)

sudo iptables -A INPUT -p tcp --dport 389 -j ACCEPT

Example: Open LDAPS port 636

sudo iptables -A INPUT -p tcp --dport 636 -j ACCEPT

Verify:

sudo iptables -L -n

Save the changes:

sudo iptables-save > /etc/sysconfig/iptables

Verify Application is Listening

Check whether a service is listening on the expected port.

Example: LDAP

ss -lntp | grep 389

Example: LDAPS

ss -lntp | grep 636

Example Output:

LISTEN 0 128 *:389 *:* users:(("slapd",pid=1234))

Display all listening TCP ports:

ss -lntp

Display all listening UDP ports:

ss -lnup

Install IPTables Service

RHEL / Rocky Linux / AlmaLinux

sudo dnf install iptables-services -y

Enable the service:

sudo systemctl enable --now iptables

Verify:

sudo systemctl status iptables

Managing firewalld

Many modern Linux distributions use firewalld by default.

Check status:

sudo systemctl status firewalld

Stop firewalld:

sudo systemctl stop firewalld

Disable firewalld at boot:

sudo systemctl disable firewalld

Stop and disable in one command:

sudo systemctl disable --now firewalld

Mask firewalld:

sudo systemctl mask firewalld

A masked service cannot be started manually or automatically.

Unmask firewalld:

sudo systemctl unmask firewalld

Disable IPTables Service

Stop and disable IPTables:

sudo systemctl disable --now iptables

Verify:

sudo systemctl status iptables

Common LDAP Firewall Ports

Example:

sudo iptables -A INPUT -p tcp --dport 389 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 636 -j ACCEPT

Troubleshooting

Display active rules:

sudo iptables -L -n -v

Display listening ports:

ss -lntp

Verify a specific port:

ss -lntp | grep 

Check service status:

systemctl status iptables

Review system logs:

journalctl -u iptables