Debian 12 provides a default firewall, nftables, that has already been configured and started. But don’t worry; having iptables installed alongside or instead of nftables is totally good, so it remains an option.<\/p>\n\n\n\n
Key differences:<\/p>\n\n\n\n
– nftables<\/strong>: Newer, more efficient framework with unified syntax<\/p>\n\n\n\n – iptables<\/strong>: A legacy framework with separate utilities for IPv4 (iptables), IPv6 (ip6tables), etc.<\/p>\n\n\n\n The features below attract many users to prefer iptables:<\/p>\n\n\n\n To get started, confirm the following:<\/p>\n\n\n\n Update of package sets and even upgrading some of the previously existing package components:<\/p>\n\n\n\n <\/p>\n\n\n\n This ensures you’re working with the latest versions of all software.<\/p>\n\n\n\n While Debian 12 comes with nftables by default, iptables can be installed easily:<\/p>\n\n\n\n <\/p>\n\n\n\n These specific commands, among others, stated above, will integrate the core manipulations that can only deal with IPv4. For users that also require support for IPv6, the commands remain the same.<\/p>\n\n\n\n After installation, confirm whether iptables is installed or not:<\/p>\n\n\n\n <\/p>\n\n\n\n Before making changes, it’s good practice to check your current firewall rules:<\/p>\n\n\n\n <\/p>\n\n\n\n The command provides an adding layer listing layer rule to check all existing manipulations associated chains set value ACCEPT overcharge entered without pre or specify.<\/p>\n\n\n\n Automatically, stored iptables rules are lost when rebooting the system. In order to enable saving and restoring rules without manual effort:<\/p>\n\n\n\n <\/p>\n\n\n\n Current rules in IPv4 and IPv6 will be asked for during saving on installation. You have the option of either saving them or skipping this step if rules are not configured yet:<\/p>\n\n\n\n <\/p>\n\n\n\n You can choose to save them or skip this step if you haven’t configured any rules yet:<\/p>\n\n\n\n <\/p>\n\n\n\n Set Basic Firewall Rules for iptables. Enable flushing all existing rules first:<\/p>\n\n\n\n <\/p>\n\n\n\n Let’s create a basic set of rules that adds the following:<\/p>\n\n\n\n Set default policies<\/p>\n\n\n\n <\/p>\n\n\n\n Policies on circumvented rules are permissive (associated and allowed).<\/p>\n\n\n\n <\/p>\n\n\n\n The permissive state allows for Loopback:<\/p>\n\n\n\n <\/p>\n\n\n\n Let\u2019s allow SSH:<\/p>\n\n\n\n <\/p>\n\n\n\n Let\u2019s allow HTTP and HTTPS:<\/p>\n\n\n\n <\/p>\n\n\n\n For ICMP (ping) Permitting:<\/p>\n\n\n\n <\/p>\n\n\n\n To view rules that have been edited:<\/p>\n\n\n\n <\/p>\n\n\n\n In order to allow changes after every reboot:<\/p>\n\n\n\n <\/p>\n\n\n\n Or alternatively:<\/p>\n\n\n\n The system guarantees that iptables are on during boot when activated:<\/p>\n\n\n\n <\/p>\n\n\n\n After configuring, start testing the firewall:<\/p>\n\n\n\n Advanced iptables Configuration<\/strong><\/p>\n\n\n\n Once you have the basics working, you might want to implement more advanced rules:<\/p>\n\n\n\n Rate Limiting SSH Connections<\/strong><\/p>\n\n\n\n SSH connection attempts can be limited to one per five-second interval to block automated login attempts:<\/p>\n\n\n\n Port Forwarding<\/strong><\/p>\n\n\n\n Change external port 8080 to internal port 80:<\/p>\n\n\n\n Dropped Packet Logging<\/strong><\/p>\n\n\n\n Enable logging for dropped packets:<\/p>\n\n\n\n Listing Rules<\/strong><\/p>\n\n\n\n For viewing all rules along with line numbers (handy for deletion):<\/p>\n\n\n\n Deleting Rules<\/strong><\/p>\n\n\n\n Delete a specific rule (replacing NUMBER with actual line number):<\/p>\n\n\n\n Inserting Rules<\/strong><\/p>\n\n\n\n Insert a rule at a specific position:<\/p>\n\n\n\n Troubleshooting Common Issues<\/strong><\/p>\n\n\n\n In this guide, we have covered how to Install Iptables on Debian 12 and perform basic to advanced configurations alongside rule persistent setups. Although Debian 12 has transitioned to using nftables <\/strong>as the default access control system, it is still comforting to know that iptables <\/strong>is an option for many sysadmins out there.<\/p>\n\n\n\n For environments where firewalls are crucial, documenting and enabling a controlled process to update such configurations. It may reduce the chances of unintended disruptions to other network services on the system.<\/p>\n\n\n\t\t\t\t\t\t\t\n
<\/a>How to Install iptable on Debian 12?<\/h2>\n\n\n\n
\n
<\/a>Step 1: Update Your System<\/h3>\n\n\n\n
sudo apt update<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-1.png\")
<\/figure>\n\n\n\n<\/a>Step 2: Install iptables<\/h3>\n\n\n\n
sudo apt install iptables -y<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-2.png\")
<\/figure>\n\n\n\nsudo apt install ip6tables -y<\/pre>\n\n\n\n
<\/a>Step 3: Verify the Installation<\/h3>\n\n\n\n
sudo iptables --version<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-3.png\")
<\/figure>\n\n\n\n<\/a>Step 4: Check Current Rules<\/h3>\n\n\n\n
sudo iptables -L -v<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-4.png\")
<\/figure>\n\n\n\n<\/a>Step 5: Install Persistent iptables Rules Package<\/h3>\n\n\n\n
sudo apt install iptables-persistent -y<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-5.png\")
<\/figure>\n\n\n\n![\"Configuring](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-6.png\")
<\/figure>\n\n\n\n![\"Configuring](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-7.png\")
<\/figure>\n\n\n\n<\/a>Step 6: Basic iptables Configuration<\/h3>\n\n\n\n
sudo iptables -F<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-8.png\")
<\/figure>\n\n\n\n\n
sudo iptables -P INPUT DROP<\/pre>\n
sudo iptables -P FORWARD DROP<\/pre>\n
sudo iptables -P OUTPUT ACCEPT<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-9.png\")
<\/figure>\n\n\n\nsudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-10.png\")
<\/figure>\n\n\n\nsudo iptables -A INPUT -i lo -j ACCEPT<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-11.png\")
<\/figure>\n\n\n\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-12.png\")
<\/figure>\n\n\n\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT<\/pre>\n
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-13.png\")
<\/figure>\n\n\n\nsudo iptables -A INPUT -p icmp -j ACCEPT<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-14.png\")
<\/figure>\n\n\n\nsudo iptables -L -v --line-numbers<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-15.png\")
<\/figure>\n\n\n\n<\/a>Step 7: Save Your Rules<\/h3>\n\n\n\n
sudo netfilter-persistent save<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-16.png\")
<\/figure>\n\n\n\nsudo iptables-save > \/etc\/iptables\/rules.v4<\/pre>\n
sudo ip6tables-save > \/etc\/iptables\/rules.v6<\/pre>\n\n\n\n
<\/a>Step 8: Enable and Start the iptables Service<\/h3>\n\n\n\n
sudo systemctl enable netfilter-persistent<\/pre>\n
sudo systemctl start netfilter-persistent<\/pre>\n\n\n\n
![\"sudo](\"http:\/\/greenwebpage.com\/community\/wp-content\/uploads\/2025\/05\/word-image-14107-17.png\")
<\/figure>\n\n\n\n<\/a>Step 9: Firewall Testing<\/h3>\n\n\n\n
\n
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set<\/pre>\n
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP<\/pre>\n\n\n\n
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 80<\/pre>\n\n\n\n
sudo iptables -N LOGGING<\/pre>\n
sudo iptables -A INPUT -j LOGGING<\/pre>\n
sudo iptables -A LOGGING -m limit --limit 2\/min -j LOG --log-prefix \"IPTables-Dropped: \" --log-level 4<\/pre>\n
sudo iptables -A LOGGING -j DROP<\/pre>\n\n\n\n
sudo iptables -L -v --line-numbers<\/pre>\n\n\n\n
sudo iptables -D INPUT NUMBER<\/pre>\n\n\n\n
sudo iptables -I INPUT 3 -p tcp --dport 3306 -j ACCEPT<\/pre>\n\n\n\n
\n
<\/a>Conclusion<\/h3>\n\n\n\n
Frequently Asked Questions <\/h3>\r\n\t\t\t\t\t\t