🆘 FAQ & Troubleshooting

Issue 1: Locked Yourself Out via SSH

Scenario: You set iptables -P INPUT DROP and then discovered SSH disconnected...

# Solution 1: Use cron scheduled recovery (leave yourself a backdoor!)
# Run this before setting the rules:
echo "iptables -F && iptables -P INPUT ACCEPT" | \
  at now + 5 minutes
# Rules auto-clear in 5 minutes to prevent lockout

# Solution 2: Write as a script with auto-rollback on error
#!/bin/bash
set -e  # Exit on any command failure

iptables -F
iptables -X
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

echo "Rules loaded successfully!"
iptables -L -v -n | head -10

# If the script is interrupted (meaning a rule has an issue),
# manually run: iptables -F && iptables -P INPUT ACCEPT

💡 Tip: 💡 Golden rule: Always allow SSH first, then change the default policy. Make it a habit to use at for scheduled recovery — this is like keeping an "emergency key" for yourself.

Issue 2: Rules Disappear After Reboot

# iptables rules are NOT persistent by default! Lost on reboot

# Debian/Ubuntu: Install persistence tool
apt install iptables-persistent

# Save current rules
netfilter-persistent save
# Actually saved to /etc/iptables/rules.v4 and rules.v6

# Restore rules
netfilter-persistent reload

# CentOS/RHEL: Use iptables-services
yum install iptables-services
systemctl enable iptables
service iptables save
# Saved to /etc/sysconfig/iptables

# Manual save/restore (universal method)
iptables-save > /etc/iptables/rules.v4
iptables-restore < /etc/iptables/rules.v4

Issue 3: Too Many Rules Causing Performance Degradation

# Check current rule count
iptables -L -n | wc -l
# Consider optimization if over 1000 rules

# Optimization strategies:
# 1. Use custom chains for categorization (covered earlier)
# 2. High-frequency rules at the top, low-frequency at the bottom
# 3. Use ipset for bulk IP matching (much faster than individual rules)

# ipset example: block 10,000 IPs
apt install ipset
ipset create blocked_ips hash:ip hashsize 65536
ipset add blocked_ips 1.2.3.4
ipset add blocked_ips 5.6.7.8
# ... bulk import from blacklist file
while read ip; do ipset add blocked_ips "$ip"; done < /tmp/blacklist.txt

# Single rule matches entire ipset
iptables -I INPUT -m set --match-set blocked_ips src -j DROP

# Save ipset
ipset save > /etc/ipset.conf
# Restore
ipset restore < /etc/ipset.conf

💡 Tip: 💡 ipset vs iptables: 10,000 IPs require 10,000 rules with iptables, compared one by one (O(n)). With ipset, you only need 1 rule + a hash table, matching is O(1). That's a 1000x performance difference!

Issue 4: Network Unreachable Between Containers/VMs

# VMs can't communicate — check the FORWARD chain
iptables -L FORWARD -v -n
Chain FORWARD (policy DROP)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
 123K 5600K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0

# If FORWARD policy is DROP without enough allow rules — traffic is being dropped
# Add allow rules
iptables -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
iptables -A FORWARD -i virbr0 -j ACCEPT
iptables -A FORWARD -o virbr0 -j ACCEPT

# Docker containers can't communicate — check the DOCKER chain
iptables -L DOCKER -v -n
# Ensure there are ACCEPT rules for inter-container traffic