LAB-SEC-02 - Introduction to iptables
Inspect iptables rules, understand chain order, and practice one small temporary rule change with a clear rollback.
Introduction to iptables
Inspect iptables rules, understand chain order, and practice one small temporary rule change with a clear rollback.
- Inspect iptables rules, understand chain order, and practice one small temporary rule change with a clear rollback.
- Repeat the workflow without copy-paste or step-by-step prompting.
- Treat security and firewall changes as high impact and validate that you still have a recovery path before applying them.
Part A: The Field Guide
What This Lab Is Really About
This lab is not about turning you into a firewall expert in one sitting.
It is about understanding:
- that packet rules are evaluated in order
- that different chains handle different traffic directions
- that direct iptables changes need careful rollback thinking
If UFW is the friendly layer, iptables helps you see what is happening underneath.
Command Reference
sudo iptables -L -n sudo iptables -L -n -v --line-numbers sudo iptables -I INPUT 1 -s 198.51.100.99 -j DROP sudo iptables -D INPUT 1
Part B: The Drill Deck
Terminal required: be cautious if this is a shared or remote system.
G Guided Step by step - type exactly this and compare the result >
Exercise G1: Inspect the Current Chains
- Run:
sudo iptables -L -n-
Identify the main chains:
- INPUT
- OUTPUT
- FORWARD
-
Read them as traffic directions rather than as random labels.
Exercise G2: Add Counters and Rule Numbers
- Run:
sudo iptables -L -n -v --line-numbers- Notice:
- rule order
- packet and byte counters
- line numbers for later deletion
Exercise G3: Insert One Temporary Rule
- Insert a test rule at the top of INPUT:
sudo iptables -I INPUT 1 -s 198.51.100.99 -j DROP- Read the INPUT chain again and confirm the new rule is first.
- This exercise is about visibility and rollback, not about trusting the IP choice to be meaningful in your lab.
S Solo Task described, hints available - figure it out >
Exercise S1: Remove the Temporary Rule
- Delete the rule you just inserted:
sudo iptables -D INPUT 1- Re-read the chain and confirm it is gone.
Exercise S2: Explain Why Order Matters
- Look at the rule list.
- Answer in your own words:
- what happens if a broad DROP rule appears above a more specific ACCEPT rule?
- why does insertion position matter?
M Mission Real scenario - no hints, combine multiple skills >
Mission M1: Design a Precise SSH Block Rule
Write, but do not necessarily apply, a rule that would:
- target the INPUT chain
- match TCP traffic
- match source subnet
203.0.113.0/24 - match destination port
22 - drop that traffic
If you can explain each part of the command, the mission is complete.
What to do next
Best next step LearningReturn to the related lesson if you want the concept explained more deeply.