Iptables Firewall Recommended Configuration on Redhat or CentOS Linux

Iptables is a firewall utility that uses policy chains to allow or block traffic.  It can configure IPv4 tables, chains or rules provided by the Linux kernel firewall.

Some key things to consider:

1. Installation:

dnf install iptables

2. Verify if iptables is enabled and see the firewall rules:

systemctl status iptables
iptables -L -n -v

3. Flush iptables rules

iptables -F

4. When working remotely, it is recommended to allow incoming SSH or port 22 connections

iptables -A INPUT -p tcp –dport 22 -m state –state NEW -j ACCEPT

5. Take note that there’s a chance of conflict if running with firewalld,ufw and nftables, so it is recommended to remove it.

systemctl disable firewalld
systemctl –now mask firewalld
systemctl –now mask nftables
ufw disable

6. Loopback interface is allowed to accept traffic. Other interfaces should be configured to deny traffic to the loopback network:


Apply the rules:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -s -j DROP

7. Outbound connections are allowed for all interfaces. Configure also to allow established connections.

iptables -A OUTPUT -p tcp -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m state –state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -m state –state ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -m state –state ESTABLISHED -j ACCEPT

8. Allow only open ports that are needed

There are few ways to verify open or listening ports, e.g. using “ss” command

Sample Output:

root@freelinux:~# ss -4tuln
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
udp UNCONN 0 0 *:5355 *:*
udp UNCONN 0 0 *:*
udp UNCONN 0 0 *:*
tcp LISTEN 0 80 *:*
tcp LISTEN 0 128 *:5355 *:*
tcp LISTEN 0 128 *:22 *:*

Syntax to allow open ports:

iptables -A INPUT -p <protocol> –dport <port> -m state –state NEW -j ACCEPT

9. Default deny should be configured

The concept is to allow ports or hosts then last rule is to default deny to drop all the traffic.

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

About the author

Free Linux

View all posts

Leave a Reply