Allow incoming http/web traffic at port 80

sudo iptables -A INPUT -p tcp -s 0/0 —sport 1024:65535 —dport 80 -m state —state NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp —sport 80 -d 0/0 —dport 1024:65535 -m state —state ESTABLISHED -j ACCEPT

Allow incoming https/secure web traffic at port 443

sudo iptables -A INPUT -p tcp -s 0/0 —sport 1024:65535 —dport 443 -m state —state NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp —sport 443 -d 0/0 —dport 1024:65535 -m state —state ESTABLISHED -j ACCEPT

Allow outgoing http/web service traffic to port 80

sudo iptables -A OUTPUT -p tcp —sport 1024:65535 -d 0/0 —dport 80 -m state —state NEW,ESTABLISHED -j ACCEPT sudo iptables -A INPUT -p tcp -s 0/0 —sport 80 —dport 1024:65535 -m state —state ESTABLISHED -j ACCEPT

Allow outgoing https/secure web service traffic to port 443

sudo iptables -A OUTPUT -p tcp —sport 1024:65535 -d 0/0 —dport 443 -m state —state NEW,ESTABLISHED -j ACCEPT sudo iptables -A INPUT -p tcp -s 0/0 —sport 443 —dport 1024:65535 -m state —state ESTABLISHED -j ACCEPT

Use the following command to ACCEPT traffic from a specific IP address. sudo iptables -A INPUT -s 192.168.0.27 —j ACCEPT

If you define dport iptables firewall rules, you need to prevent unauthorized access by dropping any traffic that comes via other ports: sudo iptables -A INPUT —j DROP

Allow ssh connection from 192.168.1.2 sudo iptables -I INPUT -s 192.168.1.2 -p tcp —dport ssh -j ACCEPT

Much more strict rule to block or allow the same (replace ACCEPT with REJECT to block) sudo iptables -I INPUT -s 192.168.1.2 -p tcp —dport ssh -m state —state NEW,ESTABLISHED,RELATED -j ACCEPT

Block ssh connection from all the host EXCEPT 192.168.1.2 iptables -I INPUT ! -s 192.168.1.2 -p tcp —dport ssh -m state —state NEW,ESTABLISHED,RELATED -j REJECT

Let us also log this message to verify our rule sudo iptables -I INPUT ! -s 192.168.1.2 -p tcp —dport ssh -m state —state NEW,ESTABLISHED,RELATED -j LOG —log-prefix “BLOCK SSH “

enable loopback traffic It’s safe to allow traffic from your own system (the localhost). Append the Input chain by entering the following: sudo iptables –A INPUT –i lo –j ACCEPT

ist all rules by entering the following: sudo iptables –L ––line–numbers

Save Your Changes

Iptables does not keep the rules you created when the system reboots. Whenever you configure iptables in Linux, all the changes you make apply only until the first restart.

To save the rules in Debian-based systems, enter: sudo /sbin/iptables–save

To save the rules in Red-Hat based systems, enter: sudo /sbin/service iptables save

The next time your system starts, iptables will automatically reload the firewall rules.

Finally, restart the firewall: sudo service iptables restart