====== Ubuntu - iptables - Basic commands ======

===== Install iptables. =====

<code bash>
sudo apt-get install iptables
</code>

----

===== Policy Chain Default Behavior. =====

<code bash>
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP
</code>

----

===== Accept all traffic on your loopback interface. =====

iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

----

===== Allow Established and Related Incoming Connections. =====

<code bash>
iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -m state --state NEW,ESTABLISHED -j ACCEPT
</code>

----

===== Allow Established Outgoing Connections =====

<code bash>
iptables -A OUTPUT -p tcp --sport 22 -d 10.10.10.10 -m state --state ESTABLISHED -j ACCEPT
</code>

----

===== Allow Internal to External =====

<code bash>
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
</code>

----

===== Drop Invalid Packets =====

<code bash>
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
</code>

----

===== Block all connections from the IP address 10.10.10.10. =====

<code bash>
iptables -A INPUT -s 10.10.10.10 -j DROP
</code>

----

===== Block all of the IP addresses in the 10.10.10.0/24 network range. =====

<code bash>
iptables -A INPUT -s 10.10.10.0/24 -j DROP
</code>

or

<code bash>
iptables -A INPUT -s 10.10.10.0/255.255.255.0 -j DROP
</code>

----

===== Block Connections to a Network Interface =====

<code bash>
iptables -A INPUT -i eth0 -s 15.15.15.51 -j DROP
</code>

----

===== Allow All Incoming SSH =====

<code bash>
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow Incoming SSH from Specific IP address or subnet =====

<code bash>
iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Block SSH connections from 10.10.10.10. =====

<code bash>
iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -j DROP
</code>

----

===== Block SSH connections from any IP address. =====

<code bash>
iptables -A INPUT -p tcp --dport ssh -j DROP
</code>

----

===== Allow Outgoing SSH =====

<code bash>
iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow Incoming Rsync from Specific IP Address or Subnet =====

<code bash>
iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming HTTP =====

<code bash>
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming HTTPS =====

<code bash>
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming HTTP and HTTPS =====

<code bash>
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow MySQL from Specific IP Address or Subnet =====

<code bash>
iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow MySQL to Specific Network Interface =====

<code bash>
iptables -A INPUT -i eth1 -p tcp --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow PostgreSQL from Specific IP Address or Subnet =====

<code bash>
iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow PostgreSQL to Specific Network Interface =====

<code bash>
iptables -A INPUT -i eth1 -p tcp --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming SMTP =====

<code bash>
iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Block Outgoing SMTP Mail =====

<code bash>
iptables -A OUTPUT -p tcp --dport 25 -j REJECT
</code>

----

===== Allow All Incoming IMAP =====

<code bash>
iptables -A INPUT -p tcp --dport 143 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 143 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming IMAPS =====

<code bash>
iptables -A INPUT -p tcp --dport 993 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 993 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming POP3 =====

<code bash>
iptables -A INPUT -p tcp --dport 110 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 110 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow All Incoming POP3S =====

<code bash>
iptables -A INPUT -p tcp --dport 995 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 995 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code>

----

===== Allow Forwarding =====

<code bash>
iptables -A FORWARD -i eth0 -o eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
</code>

----

===== Adding the NAT Rules to Direct Packets Correctly =====

<code bash>
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.0.2.2
iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport 80 -d 192.0.2.2 -j SNAT --to-source 192.0.2.15
</code>

----

===== References =====

https://www.digitalocean.com/community/tutorials/how-to-forward-ports-through-a-linux-gateway-with-iptables