📋 Cheat Sheet

Rule Operations

Operation	Command
List all rules	iptables -L -v -n --line-numbers
List a specific chain	iptables -L INPUT -v -n
List a specific table	iptables -t nat -L -v -n
Append a rule	iptables -A INPUT -p tcp --dport 80 -j ACCEPT
Insert at line 1	iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
Delete a rule by number	iptables -D INPUT 3
Flush all rules	iptables -F
Flush rules and delete custom chains	iptables -F && iptables -X
Set default policy	iptables -P INPUT DROP
Reset counters	iptables -Z
Save rules	iptables-save > /etc/iptables/rules.v4
Restore rules	iptables-restore < /etc/iptables/rules.v4

Common Match Conditions

Condition	Syntax	Example
Protocol	-p tcp/udp/icmp	-p tcp
Destination port	--dport port	--dport 80
Multiple ports	-m multiport --dports	-m multiport --dports 80,443
Source IP	-s IP/CIDR	-s 192.168.1.0/24
Destination IP	-d IP/CIDR	-d 10.0.0.50
Network interface	-i interface	-i eth0
Connection state	-m conntrack --ctstate	-m conntrack --ctstate NEW,ESTABLISHED
Rate limit	-m limit --limit	-m limit --limit 5/min
Connection limit	-m connlimit --connlimit-above	-m connlimit --connlimit-above 10
IP set	-m set --match-set	-m set --match-set blacklist src
TCP flags	--tcp-flags	--tcp-flags SYN,ACK,FIN SYN

Common Targets

Target	Purpose	Example
ACCEPT	Allow the packet	-j ACCEPT
DROP	Silently drop the packet	-j DROP
REJECT	Reject and notify the peer	-j REJECT --reject-with tcp-reset
LOG	Log, then continue matching	-j LOG --log-prefix "DROP: "
DNAT	Destination NAT / port forwarding	-j DNAT --to 10.0.0.5:8080
SNAT	Source NAT / shared public IP	-j SNAT --to 1.2.3.4
MASQUERADE	Dynamic SNAT for dial-up or dynamic IPs	-j MASQUERADE
REDIRECT	Redirect to a local port	-j REDIRECT --to-port 8080
MARK	Mark packets for policy routing	-j MARK --set-mark 1
RETURN	Return to the calling chain	-j RETURN

iptables vs nftables vs firewalld

Feature	iptables	nftables	firewalld
Era	Classic v4	Newer generation	High-level wrapper
Syntax	Verbose	Cleaner	Simple
Performance	Linear matching	Set matching, O(1)	Uses nftables underneath
Persistence	iptables-save	nft list ruleset	Persistent by design
Best for	Older systems, Docker hosts	New systems, high performance	Desktops, simple servers
Learning value	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐

💡 Tip: iptables is the foundation. Even if you eventually use nftables or firewalld, understanding tables, chains, matches, and targets makes all firewall tools much easier to reason about.