Open/Close ports on Iptables - Linux

Iptables is a user-space utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall and the chains and rules it stores. Iptables almost always comes pre-installed on any Linux distribution. Having a properly configured firewall is very important for the overall security on your server.

In this article, we will share the steps to open the ports in the Iptables firewall on Ubuntu and CentOS distributions.

Prerequisite

Sudo access to an Ubuntu or CentOS server with Iptables installed on it.

Step 1 : List the current Iptables rules

Connect to your server with Sudo access and, to list the current rules that are configured for iptables, use the below command

sudo iptables -L

We can see output as below, which will display all the rules that are configured currently

root@e2e:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:1167
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:zabbix-agent
Chain FORWARD (policy DROP)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
root@e2e:~#

Step 2 : Backup the Iptables

Before proceeding with adding rules in Iptables, we need to take a backup of the Iptables rules, in case there is any issue with the configuration, so we can restore the rules from the backup.

Use below commands to save an Iptable rule

sudo iptables-save > IPtablesbackup.txt

Step 3 : Add/Remove an Iptables rule

Once we are aware of the rules that are currently configured, we can open a port in Iptables by adding a rule using the below command.

sudo iptables -A INPUT -p tcp --dport xxxx -j ACCEPT

Note

Replace xxxx with required port number you wish to open

For example to open a Tomcat port 8080, We need to run below command.

sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

This basically tells Iptables to accept connections to Tomcat publicly.

You can view the same with iptables -L as mentioned on step1

root@:~# iptables -L
 Chain INPUT (policy DROP)
 target     prot opt source               destination
 ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
 ACCEPT     all  --  anywhere             anywhere
 ACCEPT     all  --  anywhere             anywhere
 ACCEPT     icmp --  anywhere             anywhere
 ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
 ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:http
 ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:https
 ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:1167
 ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:zabbix-agent
 ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:tomcat
 Chain FORWARD (policy DROP)
 target     prot opt source               destination
 Chain OUTPUT (policy ACCEPT)
 target     prot opt source               destination
 root@:~#

If you wish to remove the rule that was recently added, you can use the below command

sudo iptables -D INPUT -p tcp --dport xxxx -j ACCEPT

If you do not wish to open the port publicly, you can open the port for a single IP.

Use the below command to open the port only for a single IP

sudo iptables -A INPUT -p tcp -s your_server_ip --dport xxxx -j ACCEPT

Note

Kindly Replace your_server_ip to the required IP in above command and Replace xxxx with the required port

Step 4 : Block Outbound Port

To block an outbound port, you can use below command.

sudo iptables -A OUTPUT -p tcp --dport xxxx -j DROP

To block an outbound port for a specific IP, you can use below command.

sudo iptables -A OUTPUT -p tcp -d your_server_ip --dport xxxx -j DROP

Note

Kindly Replace your_server_ip to the required IP in above command and Replace xxxx with the required port

Step 5 : Save the Iptables Rule

Once we have added the rules, we need to save the rules and make them permanent. If you are using Ubuntu, you can use iptables-persistent, and for CentOS you use the iptables save command

On Ubuntu 14.04 use the following commands to save/reload the iptables rules

sudo /etc/init.d/iptables-persistent save

sudo /etc/init.d/iptables-persistent reload

On Ubuntu 16.04 and Ubuntu 18.04 use the following commands

sudo netfilter-persistent save

sudo netfilter-persistent reload

If you are using CentOS, use the below command

service iptables save

Step 6 : Restore Iptables Backup

If there is any issue with your Iptables configuration rule, you can revert back the changes with below command and restore the file which was backed up in step2.

sudo iptables-restore < IPtablesbackup.txt

Conclusion

Following the above article should have helped you open/close the ports in your Linux system. Implementing a properly configured Iptables firewall should always be a high priority for your setup, as it allows system administrators to secure their systems by allowing only the required ports publicly or restricting them to a particular IP.

---