图片来源：iptables配置实践

Save current iptables configuration:

service iptables save

List current iptables rules:

iptables -nL

Clear all iptables rules:

iptables -F

Allow ping(icmp):

iptables -A INPUT -p icmp -j ACCEPT

Open ports:

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT   # allow ssh

Allow specify ip traffic in and out

iptables -A INPUT -p tcp -s [ip] -j ACCEPT
iptables -A OUTPUT -p tcp -d [ip] -j ACCEPT

Allow NTP traffic for time synchronization:

iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp --sport 123 -j ACCEPT

Allow established connections important:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Drop all other traffic(ban all incoming traffic) put this to bottom:

iptables -A INPUT -j DROP

Redirect all dns query to specified ip:

iptables -t nat -A PREROUTING -p udp -s 192.168.1.0/24 --dport 53 -j DNAT --to 192.168.1.1

Redirect all dns query to specified ip except some ip:

iptables -t nat -A PREROUTING -p udp -s 192.168.1.24 -j ACCEPT
iptables -t nat -A PREROUTING -p udp -s 192.168.1.0/24 --dport 53 -j DNAT --to 192.168.1.1

• Iptables Essentials: Common Firewall Rules and Commands