Article 9.2 - iptables — Production Rules
Short answerUse iptables for granular control: default DROP input, allow established, rate-limit SSH, open 80/443, persist with iptables-persistent.
Overview
iptables offers lower-level firewall control than UFW. Test rules in noVNC before closing your SSH session — a wrong rule can lock you out.
Keep an open noVNC session while applying rules. Allow your SSH port before setting default DROP.
Production rules script
#!/bin/bash
# /etc/iptables/rules.sh
IPT="iptables"
$IPT -F; $IPT -X; $IPT -Z
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_LIMIT
$IPT -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 5 --name SSH_LIMIT -j DROP
$IPT -A INPUT -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 5 -j ACCEPT
$IPT -A INPUT -j LOG --log-prefix "[IPT-DROP] " --log-level 4
$IPT -A INPUT -j DROP
iptables-save > /etc/iptables/rules.v4Persist across reboot
apt install iptables-persistent -y
netfilter-persistent save
systemctl enable netfilter-persistentVerify
iptables -L -n -vshows expected allows- SSH from a second terminal still works
- HTTP/HTTPS reachable if web server installed
Frequently Asked Questions
Why not UFW?
UFW is simpler for most users — UFW guide. Use iptables when you need custom chains or rate limits UFW cannot express easily.
Changed SSH port?
Replace --dport 22 with your port in every SSH rule before enabling.
Related Articles
Need More Help?
Search this knowledgebase for related guides. If the issue persists, open a ticket at billing.vpsgrid.net with your service ID, primary IP, and steps already tried. See What Information to Include in a Support Request and Security Responsibilities on Unmanaged VPS for scope and required details.
Was this answer helpful?
