A simple iptables config example

Here's my super simple iptables config file.

It will accept SSH, HTTP and ping (ICMP) from anyone. Other inward connections will be dropped.

Outward connections or connections from the local host are not restricted in any way.

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT

In order to have the config automatically load during boot, I recommend the package iptables-persistent. On Ubuntu or Debian you should be able to install iptables-persistent with the command

sudo apt-get install iptables-persistent

Now you can save your configuration to the persistent iptable rule file

/etc/iptables/rules.v4

and load it with the command

sudo iptables-restore < /etc/iptables/rules.v4

Note that if you are using fail2ban, you should stop the fail2ban service before editing or saving persistent firewall rules. Stopping fail2ban will clear the fail2ban entries from your iptables rules. You can do this by typing

sudo service fail2ban stop

and when you are done editing the rules, restart fail2ban with

sudo service fail2ban start