The classic iptables firewall

Cheat sheet

• sudo iptables -L -n -v --line-numbers read the rules
• sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT SSH first!
• sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
• sudo iptables -I INPUT 1 -s 10.0.0.5 -j DROP ban an IP as the first rule
• sudo iptables -P INPUT DROP default policy — deny
• sudo iptables -D INPUT 3 delete rule number 3
• sudo netfilter-persistent save persist to disk

Options

Option	Meaning
-L	list rules (-n skips DNS, -v adds counters)
-t TABLE	table: filter (default), nat, mangle
-A CHAIN	append a rule to the end of the chain
-I CHAIN [N]	insert at the start / at position N
-D CHAIN N	delete rule N
-P CHAIN ACT	the chain's default policy
-F	flush the chain
-p / --dport / -s / -i	protocol / destination port / source / interface
-j	action: ACCEPT, DROP, REJECT, DNAT, SNAT, MASQUERADE
--line-numbers	rule numbers (for -D/-I)