iptables
The original Linux firewall tool, built on the kernel's netfilter framework. Still widely used, but gradually being replaced by nftables, its more efficient and easier to audit successor.
Why it is still widely used despite being older
iptables has been the default Linux firewall for over two decades, so most existing documentation, scripts and automation tooling across the internet assume it, even on distributions that now ship nftables underneath.
The rule-ordering trap
iptables processes rules top to bottom and stops at the first match. A broad "allow" rule placed above a more specific "deny" rule silently makes the deny rule useless, which is one of the most common self-inflicted firewall misconfigurations.
Frequently asked questions
Is iptables being phased out?
On modern distributions, nftables is technically doing the packet filtering underneath even when you interact with the iptables command, through a compatibility layer.
Do iptables rules survive a reboot by default?
No. Rules exist only in memory unless you explicitly save them and configure them to be restored automatically at boot, typically through iptables-persistent on Debian-based systems.
What is the simplest safe default policy?
Set the default policy on the INPUT chain to DROP, then explicitly allow only the specific ports and services you actually need.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab