How to Set Up a Firewall Using Iptables | SSH Tarpit

In this video, I go over how to set up a firewall on Linux using the built-in iptables that is in every Linux distribution. SSH Tarpit is something many people miss. .

[jlcgz]

Stopping by just to say thank you for this fantastic script. I just used it on a web server with a couple of modifications. Saved me a ton of work and time.

[Robidu]

To keep reaction times of the netfilter short, I usually put rules for reply packets as well as established or related connections quite early into the chains and only later on add rules to accept new incoming connections.
While it usually doesn't do much pain if a client has to wait a bit for netfilter to process the initial SYN packet, once the connection has been established, processing runs significantly quicker. Plus you'd also want to add rules to both the PREROUTING and the OUTPUT chains of the raw table that exempt traffic to the loopback device from being conntracked, thereby reducing the overhead. Since localhost traffic (127.0.0.1 or ::1 depending on which variant of IP you are using) isn't routed, there's no need to keep track of the packets.

[risat]

Thanks for the tutorial Chris. I was always not clear with iptables. For me, ufw and gufw for gui are really simple to use.

[AnzanHoshinRoshi]

Thank you, Chris. I've saved this one.

[TheCocoaDaddy]

Good video! I use UFW on my systems as I believe it uses iptables, behind the scenes. After watching your video, I went to my Linux Mint system and ran the "iptables -nL" command and saw the rules setup by UFW. If UFW, at least, uses iptables why advocate for manually writing your own firewall rules? Isn't using your script(s) akin to using a GUI firewall tool? I can certainly see writing firewall rules by hand to learn how iptables works and discovering the power of netfilter. I've done this before and while the learning experience can be painful, it's definitely useful.


Still, good video. I think it would be great to develop a tutorial on configuring an IPv6 firewall. While writing this post, I ran the "man iptables" command on my Mint system and discovered the "ip6tables" command. So, I think a tutorial discussing an IPv6 firewall would be of use. :) Thanks for posting!

[MaidLucy]

Oh nice to see. I did the final setup of my own VPN which spans across all my devices, homenetwork and the endpoint is in a datacenter. All done with wireguard and iptables. Finally my devices have IPv6 adresses.

[mzah]

Great video Chris, I personally use netfilter for my home routing. Love IPtables

[LtSich]

This make now 10 years that I work with linux server, but I never loved to work with iptable.
Shorewall is so much more easy for me... And intuitive, that the most important part...

[hewfrebie]

What about ufw (uncomplicated firewall)? A tutorial for beginners to understand even further. Also great tutorial! This also helps for beginners to start doing something advanced.

[firstlast-cseg]

Is this only for people running servers? Like would even running mild game server with you as host, would this apply/be necessary? Is there any drawback/why isn't this enabled by default?

[davemckewan]

Going to add this to my LM 19.2 box, as well as the hosts file entries I have and the pfSense FW it all sits behind...

[Israel]

Hello!!! Super good video, thank you. I activate the script on Debian/Xfce but by default It should block traffic from port 80, right? It shouldn't allow me to download files on the Internet, but it does. Or I'm wrong?

[mybean]

This is much better than UFW because you can customize by building small programs and then add a crontab to it just for fun( you dont really need to do that). I remember a few years ago I got so obsessed with iptables that my Apache server was overwhelmed by all the scripts I created for it. I was a fun sandbox experience though.

[tyrellmccurbin]

Thank you for sharing. Security is so important but, unfortunately, it's often overlooked.

[NeelNarayan]

I am Titu, nice to meet u. Titus for Titu & vice versa.

[CarlosSanchez-vwqo]

how can I disable libvirt's firewall rules that set up on boot?

[tedsarasin]

Can this be use for the ip6tables also?

[fqgonvl]

Thank's a lot, you provide such a fantastic content !
very useful i leaned a lot
and by the way may i ask a question ? what are the rules we have to make in iptables so we can download usung torrent client ???

[RoyHess]

I went a bit further with SSH services and other services such as VPN, CLOUD.
I restricted the acces of these service to only a few source IP adresses to narrow down the attack vector even more.
All other packets are just droped.
But Im wondering if those rules are optimal 🤔

[zyan]

Why not nftables? Better performance, syntax, combined rules and protocals, etc.