Iptables (Debian) - Versionsgeschichte

Matt am 7. November 2025 um 23:27 Uhr

2025-11-07T23:27:22Z

← Nächstältere Version		Version vom 8. November 2025, 01:27 Uhr
Zeile 1:		Zeile 1:
			Further reading: [[Nftables - nft]]

	== Commands ==		== Commands ==

Matt am 27. September 2025 um 14:07 Uhr

2025-09-27T14:07:42Z

← Nächstältere Version		Version vom 27. September 2025, 16:07 Uhr
Zeile 4:		Zeile 4:
	iptables-save > iptables.rules # Export iptables rules to iptables.rules		iptables-save > iptables.rules # Export iptables rules to iptables.rules
	iptables-restore < iptables.rules # Import iptables rules from iptables.rules		iptables-restore < iptables.rules # Import iptables rules from iptables.rules
	iptables -L # List active iptables		iptables -L # List active iptables rules
	iptables -L -v # List active iptables and show adapters		iptables -L [CHAIN] # List active iptables rules for given chain name
			iptables -L -v # List active iptables rules and show adapters
	iptables -S # List active in iptables-save-format		iptables -S # List active in iptables-save-format
	iptables -F # Flush active rules		iptables -F # Flush active rules
Zeile 14:		Zeile 15:
	=== Create Blocking Rules Manually ===		=== Create Blocking Rules Manually ===
	Block individual IP address:		Block individual IP address:
	iptables -A INPUT -s 1.2.3.4 -j DROP		sudo iptables -A INPUT -s 1.2.3.4 -j DROP
	Works with range of IP addresses as well:		Works with range of IP addresses as well:
	iptables -A INPUT -s 1.2.3.0/24 -j DROP		sudo iptables -A INPUT -s 1.2.3.0/24 -j DROP
	Make it permanent then:		Make it permanent then:
	netfilter-persistent save		netfilter-persistent save

	=== Checking How Many Packets Dropped ===		=== Checking How Many Packets Dropped ===
	iptables -L INPUT -v --line-numbers		sudo iptables -L INPUT -v --line-numbers

			=== Deleting Iptables Rules ===
			List the rules with line numbers:
			sudo iptables -L [CHAIN] –-line-numbers
			i.e.:
			sudo iptables -L INPUT –line-numbers
			Delete a rule by its number in a specific chain:
			sudo iptables -D [CHAIN] [number]
			i.e.:
			sudo iptables -D INPUT 4
			Delete by rule specification:
			sudo iptables -D [CHAIN] -p [PROTOCOL] –dport [PORT] -j [TARGET]

	== iptables on Debian ==		== iptables on Debian ==

Matt am 27. September 2025 um 13:41 Uhr

2025-09-27T13:41:20Z

← Nächstältere Version		Version vom 27. September 2025, 15:41 Uhr
Zeile 1:		Zeile 1:
	== Commands ==		== Commands ==

			=== General Commands ===
	iptables-save > iptables.rules # Export iptables rules to iptables.rules		iptables-save > iptables.rules # Export iptables rules to iptables.rules
	iptables-restore < iptables.rules # Import iptables rules from iptables.rules		iptables-restore < iptables.rules # Import iptables rules from iptables.rules
Zeile 10:		Zeile 11:
	iptables -L -n # List active iptables with numeric output		iptables -L -n # List active iptables with numeric output
	Parameter <code>-n</code> leads to showing numeric values. This prevents reverse DNS lookup for IP Adresses possibly slowing the whole process.		Parameter <code>-n</code> leads to showing numeric values. This prevents reverse DNS lookup for IP Adresses possibly slowing the whole process.

			=== Create Blocking Rules Manually ===
			Block individual IP address:
			iptables -A INPUT -s 1.2.3.4 -j DROP
			Works with range of IP addresses as well:
			iptables -A INPUT -s 1.2.3.0/24 -j DROP
			Make it permanent then:
			netfilter-persistent save

			=== Checking How Many Packets Dropped ===
			iptables -L INPUT -v --line-numbers

	== iptables on Debian ==		== iptables on Debian ==

Matt: /* Commands */

2025-09-20T10:42:07Z

Commands

← Nächstältere Version		Version vom 20. September 2025, 12:42 Uhr
Zeile 7:		Zeile 7:
	iptables -S # List active in iptables-save-format		iptables -S # List active in iptables-save-format
	iptables -F # Flush active rules		iptables -F # Flush active rules
			In case of <code>iptables -L</code> being very slow try:
			iptables -L -n # List active iptables with numeric output
			Parameter <code>-n</code> leads to showing numeric values. This prevents reverse DNS lookup for IP Adresses possibly slowing the whole process.

	== iptables on Debian ==		== iptables on Debian ==

Matt: /* Enable Automatic Load of Rules at Startup */

2020-09-27T08:36:11Z

Enable Automatic Load of Rules at Startup

← Nächstältere Version		Version vom 27. September 2020, 10:36 Uhr
Zeile 22:		Zeile 22:
	=== Enable Automatic Load of Rules at Startup ===		=== Enable Automatic Load of Rules at Startup ===

	Copy ~~import rules~~ script to '''/etc/network/if-pre-up.d/'''		Copy iptables-restore script to '''/etc/network/if-pre-up.d/'''

	Add execution permissions:		Add execution permissions:

Matt: /* Enable Automatic Load of Rules at Startup */

2020-09-27T08:35:51Z

Enable Automatic Load of Rules at Startup

← Nächstältere Version		Version vom 27. September 2020, 10:35 Uhr
Zeile 22:		Zeile 22:
	=== Enable Automatic Load of Rules at Startup ===		=== Enable Automatic Load of Rules at Startup ===

	Copy ~~load~~ rules script to '''/etc/network/if-pre-up.d/'''		Copy import rules script to '''/etc/network/if-pre-up.d/'''

	Add execution permissions:		Add execution permissions:

Matt am 27. September 2020 um 08:35 Uhr

2020-09-27T08:35:25Z

← Nächstältere Version		Version vom 27. September 2020, 10:35 Uhr
Zeile 1:		Zeile 1:
	== Commands ==		== Commands ==
	~~iptables-restore < iptables.rules # Regeln aus iptables.rules in IPTables importieren~~
	~~iptables-save > iptables.rules # Regeln aus iptables.rules nach IPTables exportieren~~
	~~iptables -L # Aktive Firewallkonfiguration anzeigen~~
	~~iptables -L -v # Aktive Firewallkonfiguration mit mehr Details anzeigen~~
	~~iptables -S # Aktive Firewallregeln anzeigen~~
	~~iptables -F # Flush / Aktive Regeln löschen~~

	== iptables ~~1.4.21 auf~~ Debian ~~8.0 einrichten~~ ==		iptables-save > iptables.rules # Export iptables rules to iptables.rules
			iptables-restore < iptables.rules # Import iptables rules from iptables.rules
			iptables -L # List active iptables
			iptables -L -v # List active iptables and show adapters
			iptables -S # List active in iptables-save-format
			iptables -F # Flush active rules

			== iptables on Debian ==

			=== Add iptables Rule File ===

			Copy '''iptables.rules''' to '''/etc'''

	~~cd /etc~~
	~~wget <iptables rules file>~~
	chown root:root iptables.rules		chown root:root iptables.rules
	chmod 600 iptables.rules		chmod 600 iptables.rules
	~~nano iptables.test.rules # update at least SSH port~~
	iptables-restore < iptables.rules		iptables-restore < iptables.rules

	~~Prüfen~~, ~~ob SSH Zugriff noch funktioniert~~.		Check, if still works.

			=== Enable Automatic Load of Rules at Startup ===

			Copy load rules script to '''/etc/network/if-pre-up.d/'''

	~~iptables Konfiguration beim Netzwerk Startup laden~~:		Add execution permissions:

	~~iptables-save > iptables.rules~~
	~~chown root:root iptables.rules~~
	~~chmod 600 iptables.rules~~
	~~cd /etc/network/if-pre-up.d/~~
	~~wget <iptables load file>~~
	chmod +x iptables		chmod +x iptables

	~~Hierfür kann auch der Dienst~~ iptables-persistent ~~genutzt werden. Muss vorher installiert werden~~:		The package '''iptables-persistent''' which also can be used for persisting iptables:

	# apt-get install iptables-persistent		# apt-get install iptables-persistent

	== ipset ~~Blacklist~~ ==		== Blacklisting with ipset with Automatic Updates ==

	~~https://github.com/trick77/ipset-blacklist~~


			See: https://github.com/trick77/ipset-blacklist

	.
	[[Category:Linux]]		[[Category:Linux]]
	[[Category:Terminal]]		[[Category:Terminal]]

Matt am 27. September 2020 um 08:24 Uhr

2020-09-27T08:24:34Z

← Nächstältere Version		Version vom 27. September 2020, 10:24 Uhr
Zeile 1:		Zeile 1:
	== ~~Befehle~~ ==		== Commands ==
	iptables-restore < iptables.rules # Regeln aus iptables.rules in IPTables importieren		iptables-restore < iptables.rules # Regeln aus iptables.rules in IPTables importieren
	iptables-save > iptables.rules # Regeln aus iptables.rules nach IPTables exportieren		iptables-save > iptables.rules # Regeln aus iptables.rules nach IPTables exportieren

Matt am 18. Oktober 2017 um 21:21 Uhr

2017-10-18T21:21:53Z

← Nächstältere Version		Version vom 18. Oktober 2017, 23:21 Uhr
Zeile 29:		Zeile 29:
	Hierfür kann auch der Dienst iptables-persistent genutzt werden. Muss vorher installiert werden:		Hierfür kann auch der Dienst iptables-persistent genutzt werden. Muss vorher installiert werden:
	# apt-get install iptables-persistent		# apt-get install iptables-persistent

			== ipset Blacklist ==

			https://github.com/trick77/ipset-blacklist



	.		.
	[[Category:Linux]]		[[Category:Linux]]
	[[Category:Terminal]]		[[Category:Terminal]]

Matt am 18. Oktober 2017 um 21:15 Uhr

2017-10-18T21:15:52Z

← Nächstältere Version		Version vom 18. Oktober 2017, 23:15 Uhr
Zeile 9:		Zeile 9:
	== iptables 1.4.21 auf Debian 8.0 einrichten ==		== iptables 1.4.21 auf Debian 8.0 einrichten ==

	# cd /etc		cd /etc
	~~<nowiki>#</nowiki>~~ wget <iptables rules file>		wget <iptables rules file>
	~~<nowiki>#</nowiki>~~ chown root:root iptables.rules		chown root:root iptables.rules
	~~<nowiki>#</nowiki>~~ chmod 600 iptables.rules		chmod 600 iptables.rules
	~~<nowiki>#</nowiki>~~ nano iptables.test.rules # update at least SSH port		nano iptables.test.rules # update at least SSH port
	~~<nowiki>#</nowiki>~~ iptables-restore < iptables.rules		iptables-restore < iptables.rules

	Prüfen, ob SSH Zugriff noch funktioniert.		Prüfen, ob SSH Zugriff noch funktioniert.
Zeile 20:		Zeile 20:
	iptables Konfiguration beim Netzwerk Startup laden:		iptables Konfiguration beim Netzwerk Startup laden:

	# iptables-save > iptables.rules		iptables-save > iptables.rules
	~~<nowiki>#</nowiki>~~ chown root:root iptables.rules		chown root:root iptables.rules
	~~<nowiki>#</nowiki>~~ chmod 600 iptables.rules		chmod 600 iptables.rules
	~~<nowiki>#</nowiki>~~ cd /etc/network/if-pre-up.d/		cd /etc/network/if-pre-up.d/
	~~<nowiki>#</nowiki>~~ wget <iptables load file>		wget <iptables load file>
	~~<nowiki>#</nowiki>~~ chmod +x iptables		chmod +x iptables

	Hierfür kann auch der Dienst iptables-persistent genutzt werden. Muss vorher installiert werden:		Hierfür kann auch der Dienst iptables-persistent genutzt werden. Muss vorher installiert werden:
	# apt-get install iptables-persistent		# apt-get install iptables-persistent

			.
	[[Category:Linux]]		[[Category:Linux]]
	[[Category:Terminal]]		[[Category:Terminal]]