iptables / nftables Cheatsheet

Quick reference for iptables and nftables commands covering basic rules, chains, NAT, filtering, mangle, save/restore, and nftables migration

Related Categories:NetworkSecurity

58 commands

iptables -L

List all rules

sudo iptables -L

iptables -L -n

List rules with numeric output

sudo iptables -L -n

iptables -L -v

List rules with verbose output

sudo iptables -L -v --line-numbers

iptables -L -t nat

List rules in NAT table

sudo iptables -L -t nat

iptables -L -t mangle

List rules in mangle table

sudo iptables -L -t mangle

iptables -S

List rules in iptables-save format

sudo iptables -S

iptables -F

Flush all rules

sudo iptables -F

iptables -X

Delete all user-defined chains

sudo iptables -X

iptables -Z

Zero all packet counters

sudo iptables -Z

iptables -P

Set default chain policy

sudo iptables -P INPUT DROP

iptables -A INPUT

Append rule to INPUT chain

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

iptables -A OUTPUT

Append rule to OUTPUT chain

sudo iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

iptables -A FORWARD

Append rule to FORWARD chain

sudo iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

iptables -I

Insert rule at top of chain

sudo iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

iptables -D

Delete rule from chain

sudo iptables -D INPUT -p tcp --dport 80 -j ACCEPT

iptables -D (line)

Delete rule by line number

sudo iptables -D INPUT 3

iptables -R

Replace rule in chain

sudo iptables -R INPUT 1 -p tcp --dport 8080 -j ACCEPT

iptables -N

Create user-defined chain

sudo iptables -N MYCHAIN

iptables -t nat -A POSTROUTING MASQUERADE

Set up IP masquerade (SNAT)

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -t nat -A PREROUTING DNAT

Set up destination NAT (port forward)

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080

iptables -t nat -A POSTROUTING SNAT

Set up source NAT

sudo iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 203.0.113.1

iptables -t nat -A OUTPUT REDIRECT

Set up local port redirect

sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING REDIRECT

Redirect incoming traffic port

sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443

iptables -t nat -F

Flush NAT table rules

sudo iptables -t nat -F

iptables -t nat -L PREROUTING

List PREROUTING NAT rules

sudo iptables -t nat -L PREROUTING -n

iptables -A INPUT -s (allow IP)

Allow connection from specific IP

sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

iptables -A INPUT -s (deny IP)

Deny connection from specific IP

sudo iptables -A INPUT -s 10.0.0.5 -j DROP

iptables -A INPUT --dport (allow port)

Allow connection to specific port

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

iptables -A INPUT -m multiport

Allow multiple ports at once

sudo iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT

iptables -A INPUT -m state ESTABLISHED

Allow established connections

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i lo

Allow loopback interface

sudo iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -p icmp

Allow/deny ICMP (ping)

sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

iptables -A INPUT -m conntrack

Filter with connection tracking

sudo iptables -A INPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -m limit

Set rate limiting

sudo iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min -j ACCEPT

iptables -A INPUT -j LOG

Log packets

sudo iptables -A INPUT -j LOG --log-prefix 'DROPPED: '

iptables -t mangle -A PREROUTING TOS

Modify TOS field

sudo iptables -t mangle -A PREROUTING -p tcp --dport 22 -j TOS --set-tos Minimize-Delay

iptables -t mangle -A PREROUTING TTL

Set TTL value

sudo iptables -t mangle -A PREROUTING -j TTL --ttl-set 64

iptables -t mangle -A PREROUTING MARK

Mark packets

sudo iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 1

iptables -t mangle -A POSTROUTING MSS

Adjust TCP MSS

sudo iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

iptables -t mangle -A OUTPUT DSCP

Set DSCP field

sudo iptables -t mangle -A OUTPUT -p tcp --dport 5060 -j DSCP --set-dscp-class EF

iptables -t mangle -F

Flush mangle table rules

sudo iptables -t mangle -F

iptables-save

Save current rules to stdout

sudo iptables-save > /etc/iptables/rules.v4

iptables-restore

Restore rules from file

sudo iptables-restore < /etc/iptables/rules.v4

ip6tables-save

Save IPv6 rules

sudo ip6tables-save > /etc/iptables/rules.v6

ip6tables-restore

Restore IPv6 rules

sudo ip6tables-restore < /etc/iptables/rules.v6

netfilter-persistent save

Save with netfilter-persistent

sudo netfilter-persistent save

netfilter-persistent reload

Reload saved rules

sudo netfilter-persistent reload

iptables-save -c

Save rules with counters

sudo iptables-save -c > /tmp/rules-with-counters

nft list ruleset

List entire ruleset

sudo nft list ruleset

nft list tables

List all tables

sudo nft list tables

nft list table

List rules in specific table

sudo nft list table inet filter

nft add table

Add a table

sudo nft add table inet myfilter

nft add chain

Add a chain

sudo nft add chain inet myfilter input '{ type filter hook input priority 0; policy accept; }'

nft add rule

Add a rule

sudo nft add rule inet myfilter input tcp dport 22 accept

nft delete rule

Delete a rule

sudo nft delete rule inet myfilter input handle 4

nft flush ruleset

Flush entire ruleset

sudo nft flush ruleset

nft -f

Load ruleset from file

sudo nft -f /etc/nftables.conf

iptables-translate

Translate iptables rule to nftables

iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT