Basic Iptables Insert

When you need a firewall rule to take effect before existing rules, appending it to the end won’t cut it. The -I (insert) option in iptables lets you place a rule at an exact position in a chain, giving you precise control over packet processing order.

Basic Syntax

The basic syntax for inserting a rule is:

sudo iptables -I <chain> [rulenum] <rule-specification>

Explanation of Components

• sudo: Necessary for executing iptables commands with root privileges.
• -I: The insert option.
• <chain>: The name of the chain where the rule will be inserted (e.g., INPUT, OUTPUT, FORWARD, or a custom chain).
• [rulenum]: (Optional) The position at which to insert the rule. If omitted, the rule is inserted at the beginning of the chain (position 1). Existing rules at and after the specified position are shifted down.
• <rule-specification>: Defines the criteria and action for the rule. This includes:
  • -s <source-ip/network>: Source IP address or network.
  • -d <destination-ip/network>: Destination IP address or network.
  • -p <protocol>: Protocol (e.g., tcp, udp, icmp, all).
  • --dport <port>: Destination port for TCP/UDP.
  • -i <interface>: Incoming interface.
  • -o <interface>: Outgoing interface.
  • -j <target>: The action to take (e.g., ACCEPT, DROP, REJECT, LOG, or jump to another chain).

Example

To insert a rule at position 2 in the INPUT chain that accepts TCP traffic on port 22 (SSH) from the network 192.168.1.0/24:

sudo iptables -I INPUT 2 -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

• SysAdmin
• Security

• Bash
• SysAdmin
• Troubleshooting