On Debian, iptables is a command-line utility for configuring packet filtering, NAT, and firewall rules. Since Debian 10 (Buster), the default backend is nftables via the iptables-nft compatibility layer, but you can still use the traditional syntax.
Installing iptables
If not already installed:
sudo apt update
sudo apt install iptables -y
You can check the current rules with:
sudo iptables -L
This lists the INPUT, FORWARD, and OUTPUT chains with their policies and rules .
Adding Rules
To allow incoming SSH traffic on port 22:
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
To allow HTTP/HTTPS:
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
To drop all other inbound traffic:
sudo iptables -A INPUT -j REJECT
sudo iptables -A FORWARD -j REJECT
You can view detailed rules with:
sudo iptables -L -n -v
Saving Rules Permanently
By default, iptables rules are lost after reboot. To persist them:
Using iptables-persistent package:
sudo apt install iptables-persistent
sudo sh -c '/sbin/iptables-save > /etc/iptables/rules.v4'
sudo sh -c '/sbin/ip6tables-save > /etc/iptables/rules.v6'
Ensure the service is enabled:
sudo systemctl enable netfilter-persistent.service
Manual restore on boot: Create /etc/network/if-pre-up.d/iptables:
#!/bin/sh
/sbin/iptables-restore < /etc/iptables.up.rules #/etc/iptables/rules.v4 可以注释不用也不影响
Make it executable:
sudo chmod +x /etc/network/if-pre-up.d/iptables
Switching Between nftables and Legacy
If you need legacy iptables instead of nftables backend:
sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
Switch back to nftables:
sudo update-alternatives --set iptables /usr/sbin/iptables-nft
Tip: Always test new firewall rules in a separate SSH session to avoid locking yourself out.
