Typorithm · medium

Firewalls & iptables

firewall-iptablessecurityfirewalliptablessegmentation

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Firewalls & iptables

Network Security

A host firewall should default-deny (-P INPUT DROP) and then explicitly allow only needed ports like SSH. A stateful rule (-m state --state ESTABLISHED) permits replies to connections you started. Chains are INPUT, OUTPUT, and FORWARD; segmentation between zones limits an attacker's blast radius.

A well-configured host firewall starts with a default-deny policy: -P INPUT DROP rejects every inbound packet unless a later rule explicitly allows it. You then open only the ports the host actually needs.

iptables organizes rules into chains — INPUT for traffic to the host, OUTPUT for traffic from it, and FORWARD for traffic routed through it. -A appends a rule to a chain, matching on protocol, port, or connection state.

A stateful firewall tracks connection state, so an ESTABLISHED rule lets replies flow back without opening ports broadly. Beyond a single host, network segmentation isolates zones so that if an attacker lands in one segment, they cannot freely reach the rest.

Default-deny first, then allow only needed ports.

Chains: INPUT / OUTPUT / FORWARD.

Stateful rules permit replies to established connections.

iptables -P INPUT DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -L -n -v

Read the implementation

Connect each part of the code to the concept before you type.

1. Default-deny policy

-P sets the default policy for the INPUT chain to DROP, so anything not explicitly allowed is rejected.

iptables -P INPUT DROP

2. Allow SSH

-A appends a rule allowing inbound TCP on port 22 (SSH) — one of the few ports you open after a default-deny.

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

3. Stateful rule

The state module accepts packets belonging to ESTABLISHED connections, so replies to outbound traffic are permitted.

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

4. List rules

-L lists the rules; -n skips DNS lookups and -v shows packet/byte counters for auditing.

iptables -L -n -v

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.