How to Completely Disable ‘Iptables’ (Legacy Firewall) System-Wide in Ubuntu Server

For decades, iptables has been the gold standard for defining IPv4 packet filtering rules and NAT configurations in the Linux kernel. However, modern Ubuntu Server deployments have largely transitioned to ufw (Uncomplicated Firewall) or nftables for firewall management. If you are configuring a server that sits entirely behind a dedicated, hardware-based enterprise firewall (like a Palo Alto or Cisco ASA appliance), or if you are running a highly specific internal Docker host where complex local packet filtering is causing routing conflicts, you may want to ensure that iptables is completely flushed and out of the way.

This guide explains how to completely disable iptables filtering system-wide in Ubuntu Server by flushing all rules and setting default policies to ACCEPT.

Flush Rules and Reset Default Policies

Because iptables is not a background “daemon” or service (it is simply a user-space utility used to inject rules directly into the Netfilter framework of the kernel), you cannot “stop” it using systemctl. To disable it, you must clear its memory and ensure it accepts all traffic.

1. Log into your Ubuntu Server via SSH or local console with sudo privileges.
2. First, set the default policy for the three primary chains (INPUT, FORWARD, and OUTPUT) to ACCEPT, meaning no traffic will be blocked by default:

   sudo iptables -P INPUT ACCEPT
   sudo iptables -P FORWARD ACCEPT
   sudo iptables -P OUTPUT ACCEPT

3. Next, flush (delete) all existing rules from the standard filter table:

   sudo iptables -F

4. Flush any rules in the NAT and Mangle tables (if you were using them for routing):

   sudo iptables -t nat -F
   sudo iptables -t mangle -F

5. Finally, delete any custom chains that may have been created by third-party software:

   sudo iptables -X
   sudo iptables -t nat -X
   sudo iptables -t mangle -X

Prevent Rules from Restoring on Reboot

If you reboot your server right now, it is possible that a package like iptables-persistent or netfilter-persistent will automatically reload old rules from a saved file (usually located in /etc/iptables/rules.v4).

To guarantee the firewall remains completely disabled upon reboot, stop and disable the persistent service:

sudo systemctl stop netfilter-persistent
sudo systemctl disable netfilter-persistent

You can verify that the system is completely open by running sudo iptables -L -n. The output should show all chains with the policy ACCEPT and absolutely zero rules listed beneath them. Your Ubuntu Server will now rely entirely on your external hardware firewall for network security.