iptables: rules for a home network

reference · networking

The card stays for older machines, and because iptables syntax keeps showing up in other people's documentation. On Debian 12 iptables is a thin layer over nftables (the iptables-nft package) – new rules belong directly in nft.

outdated The author marked this content as superseded.

Commands

command purpose

iptables -L -n -v list filter rules with counters

iptables -S list rules in the form used to enter them

iptables -t nat -L -n list the NAT table

iptables-save > rules.v4 dump the whole ruleset to a file

iptables-restore < rules.v4 load a ruleset from a file

Tables and chains

table chains

filter INPUT, FORWARD, OUTPUT accept or drop traffic

nat PREROUTING, POSTROUTING address rewriting, masquerade

mangle all header changes

Masquerade for a shared uplink

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

The ruleset is lost on reboot; iptables-persistent makes it survive, or /etc/nftables.conf in the nftables world.