💡 Practical Experience

Set Up an AT Scheduled Recovery Before Changing Rules

Every time before modifying iptables rules, run echo "iptables -F && iptables -P INPUT ACCEPT" | at now + 5 minutes. If the change is correct, cancel the scheduled job. If it's wrong, the system auto-recovers in 5 minutes. This rule can save your life.

Docker is iptables' Nemesis

You think you've blocked a port, but Docker container ports are still reachable — because Docker bypasses the INPUT chain. On a Docker host, only the DOCKER-USER chain can control container ports — the INPUT chain has no effect on Docker port mappings.

Rule Order Determines Everything

iptables matches top to bottom, one rule at a time, and the first match wins. If you put ACCEPT after DROP, it will never match. Allow rules first, deny rules after — this is the iron rule.

Don't Use LOG Unrestricted

-j LOG writes a log entry for every matching packet. If you LOG all traffic, your logging system will instantly explode — disk fills up, rsyslog hangs, and even sshd is affected. Add -m limit --limit 5/min before LOG to rate-limit.