How to Configure Advanced Iptables Rules on Ubuntu Server

While Uncomplicated Firewall (UFW) is fantastic for basic port blocking, it is simply a user-friendly frontend for the underlying Linux packet filtering framework: Netfilter. To access the true power of Netfilter—such as port forwarding, NAT, and complex stateful packet inspection—system administrators must bypass UFW and use the iptables utility directly. Understanding iptables is a mandatory skill for any serious Ubuntu server administrator.

The Architecture of Iptables

Iptables is built on three core concepts:

1. Tables: The highest level of organization. The default is the filter table (used for allowing/blocking). The nat table is used for Network Address Translation. The mangle table alters packet headers.
2. Chains: Within each table are chains, which dictate when a rule is applied. The filter table has INPUT (traffic destined for the server), FORWARD (traffic passing through), and OUTPUT (traffic originating from the server).
3. Rules: The specific conditions a packet must meet (e.g., protocol TCP, port 80) and the Target (action) to take (e.g., ACCEPT, DROP, or REJECT).

Step 1: Viewing Current Rules

Before adding rules, you must know what is currently configured. To view the rules in the default filter table with line numbers (which are essential for deleting specific rules later):

sudo iptables -L --line-numbers -v

The -v flag provides verbose output, showing how many packets and bytes have matched each rule.

Step 2: Appending a Rule to Block an IP Address

Suppose you notice malicious traffic originating from the IP address 203.0.113.50. You want to drop all traffic from this IP.

sudo iptables -A INPUT -s 203.0.113.50 -j DROP

• -A INPUT: Append (add to the bottom) of the INPUT chain.
• -s: The source IP address.
• -j DROP: Jump to the DROP target (silently discard the packet).

Step 3: Inserting a Rule (Order Matters)

Iptables processes rules top-down. As soon as a packet matches a rule, the action is taken, and processing stops. If you have a rule at the top that says ACCEPT all traffic, the DROP rule you appended in Step 2 will never be evaluated.

To insert a rule at the top of the chain (position 1), use the -I flag:

sudo iptables -I INPUT 1 -p tcp --dport 22 -s 192.168.1.100 -j ACCEPT

This explicitly allows SSH (port 22) traffic from a specific admin IP address before any other rules are processed.

Step 4: Deleting a Rule

If you made a mistake, you can delete a rule by referencing its line number in the chain.

sudo iptables -D INPUT 3

This deletes the 3rd rule in the INPUT chain.

Step 5: Saving the Rules (Crucial Step)

Iptables rules are ephemeral. If you reboot the server, every rule you just typed will be erased. To make them persistent across reboots, you must install the iptables-persistent package.

sudo apt install iptables-persistent

During installation, it will ask if you want to save current IPv4 and IPv6 rules. Select Yes. If you modify your rules later, you must manually save them to the configuration file using this command:

sudo netfilter-persistent save

Mastering iptables gives you granular, surgical control over the network traffic flowing in and out of your Ubuntu server, far beyond what simple firewall wrappers can provide.