Date: 16-12-2015

IPTables is a Linux firewall utility used to control network traffic entering and leaving a system. While many modern Linux distributions use Firewalld or nftables by default, IPTables is still commonly used in enterprise environments and appliance deployments.

Best Practices

• Back up firewall rules before making changes.
• Use specific source IP restrictions whenever possible.
• Verify services are listening before opening firewall ports.
• Save rules after making modifications.
• Test connectivity after firewall changes.
• Maintain console access when performing firewall maintenance.
• Restrict LDAP and LDAPS access to trusted networks whenever possible.

Check IPTables Service Status

Display the current IPTables service status:

sudo systemctl status iptables

Common service commands:

sudo systemctl start iptables
sudo systemctl stop iptables
sudo systemctl restart iptables
sudo systemctl enable iptables
sudo systemctl disable iptables

View Current Firewall Rules

Display all active rules:

sudo iptables -L -n -v

Display rules in save format:

sudo iptables-save

Backup Existing Rules

Before making changes, create a backup:

sudo iptables-save > /root/iptables.backup

Verify the backup:

cat /root/iptables.backup

Restore Firewall Rules

Restore a previously saved configuration:

sudo iptables-restore < /root/iptables.backup

Reset IPTables Rules

Flush all active rules:

sudo iptables --flush

or

sudo iptables -F

Warning: This immediately removes all active rules and may expose the system to network traffic.

Display the current rules after flushing:

sudo iptables -L -n -v

Save Firewall Changes

After modifying rules, save the current configuration:

sudo iptables-save > /etc/sysconfig/iptables

Restart the service:

sudo systemctl restart iptables

Open a TCP Port

Example: Open TCP port 389 (LDAP)

sudo iptables -A INPUT -p tcp --dport 389 -j ACCEPT

Example: Open LDAPS port 636

sudo iptables -A INPUT -p tcp --dport 636 -j ACCEPT

Verify:

sudo iptables -L -n

Save the changes:

sudo iptables-save > /etc/sysconfig/iptables

Verify Application is Listening

Check whether a service is listening on the expected port.

Example: LDAP

ss -lntp | grep 389

Example: LDAPS

ss -lntp | grep 636

Example Output:

LISTEN 0 128 *:389 *:* users:(("slapd",pid=1234))

Display all listening TCP ports:

ss -lntp

Display all listening UDP ports:

ss -lnup

Install IPTables Service

RHEL / Rocky Linux / AlmaLinux

sudo dnf install iptables-services -y

Enable the service:

sudo systemctl enable --now iptables

Verify:

sudo systemctl status iptables

Managing firewalld

Many modern Linux distributions use firewalld by default.

Check status:

sudo systemctl status firewalld

Stop firewalld:

sudo systemctl stop firewalld

Disable firewalld at boot:

sudo systemctl disable firewalld

Stop and disable in one command:

sudo systemctl disable --now firewalld

Mask firewalld:

sudo systemctl mask firewalld

A masked service cannot be started manually or automatically.

Unmask firewalld:

sudo systemctl unmask firewalld

Disable IPTables Service

Stop and disable IPTables:

sudo systemctl disable --now iptables

Verify:

sudo systemctl status iptables

Common LDAP Firewall Ports

Example:

sudo iptables -A INPUT -p tcp --dport 389 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 636 -j ACCEPT

Troubleshooting

Display active rules:

sudo iptables -L -n -v

Display listening ports:

ss -lntp

Verify a specific port:

ss -lntp | grep <port>

Check service status:

systemctl status iptables

Review system logs:

journalctl -u iptables