Practice Use drills for recall and labs for real operating judgment.

LAB-SEC-02 - Introduction to iptables

Inspect iptables rules, understand chain order, and practice one small temporary rule change with a clear rollback.

SEC Security & Firewalls

Introduction to iptables

Inspect iptables rules, understand chain order, and practice one small temporary rule change with a clear rollback.

35 min INTERMEDIATE LINUX Curriculum-reviewed
Prerequisites
Lab LAB-SEC-01 - The UFW Firewall
Success criteria
  • Inspect iptables rules, understand chain order, and practice one small temporary rule change with a clear rollback.
  • Repeat the workflow without copy-paste or step-by-step prompting.
Safety notes
  • Direct iptables work is high impact. Avoid broad flush or default-policy changes unless you fully understand the consequences.

Part A: The Field Guide

What This Lab Is Really About

This lab is not about turning you into a firewall expert in one sitting.

It is about understanding:

  • that packet rules are evaluated in order
  • that different chains handle different traffic directions
  • that direct iptables changes need careful rollback thinking

If UFW is the friendly layer, iptables helps you see what is happening underneath.

Command Reference

Useful iptables inspection commands

sudo iptables -L -n sudo iptables -L -n -v —line-numbers sudo iptables -I INPUT 1 -s 198.51.100.99 -j DROP sudo iptables -D INPUT 1

Part B: The Drill Deck

Terminal required: be cautious if this is a shared or remote system.

G
Guided Step by step - type exactly this and compare the result
>

Exercise G1: Inspect the Current Chains

  1. Run:
sudo iptables -L -n

  1. Identify the main chains:

    • INPUT
    • OUTPUT
    • FORWARD

  2. Read them as traffic directions rather than as random labels.

Exercise G2: Add Counters and Rule Numbers

  1. Run:
sudo iptables -L -n -v --line-numbers
  1. Notice:
    • rule order
    • packet and byte counters
    • line numbers for later deletion

Exercise G3: Insert One Temporary Rule

  1. Insert a test rule at the top of INPUT:
sudo iptables -I INPUT 1 -s 198.51.100.99 -j DROP
  1. Read the INPUT chain again and confirm the new rule is first.
  2. This exercise is about visibility and rollback, not about trusting the IP choice to be meaningful in your lab.
S
Solo Task described, hints available - figure it out
>

Exercise S1: Remove the Temporary Rule

  1. Delete the rule you just inserted:
sudo iptables -D INPUT 1
  1. Re-read the chain and confirm it is gone.

Exercise S2: Explain Why Order Matters

  1. Look at the rule list.
  2. Answer in your own words:
    • what happens if a broad DROP rule appears above a more specific ACCEPT rule?
    • why does insertion position matter?
M
Mission Real scenario - no hints, combine multiple skills
>

Mission M1: Design a Precise SSH Block Rule

Write, but do not necessarily apply, a rule that would:

  • target the INPUT chain
  • match TCP traffic
  • match source subnet 203.0.113.0/24
  • match destination port 22
  • drop that traffic

If you can explain each part of the command, the mission is complete.