What is iptables?
Linux iptables firewall tools
iptables (the Linux iptables firewall tools) is the older Linux firewall command, which on current Debian writes nftables rules underneath while keeping its old syntax.
iptables organises rules into fixed tables (filter, nat, mangle, raw) with built-in chains named after the netfilter hooks: INPUT, FORWARD, OUTPUT, PREROUTING and POSTROUTING. Rules are added one command at a time (iptables -A INPUT -p tcp --dport 22 -j ACCEPT), and separate commands handle IPv6 (ip6tables), ARP and bridging. Since Debian 10 the iptables command is iptables-nft: it accepts the same commands but stores them as nftables tables and chains, which nft list ruleset shows. The original kernel implementation is still available as iptables-legacy.
You meet iptables in older guides and in software that manages its own rules, such as Docker and fail2ban. Because its rules live in their own tables and chains on the same hooks as yours, a drop in either firewall blocks a packet, and an iptables ACCEPT can't override an nftables drop: the usual cause of "I allowed it and it's still blocked". iptables-translate converts commands to nft syntax for migrating. The nftables and iptables on Debian lesson shows both tools on one machine.
Lessons that use iptables
- nftables and iptables on Debian: host and router firewallsTeaches this term · Intermediate · 60 min
Build a Debian firewall with nftables, from a host firewall to an office router with NAT and port forwards: safe changes with a timed rollback, sets and maps, logging and packet tracing, and what iptables really is on Debian 13.
- Debugging BGP: every session state, reproducedIntermediate · 60 min
Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.
- Why not just keep it simple?Beginner · 25 min
Why networks use routing protocols, BGP and redundant links instead of a few static routes, when they shouldn't, and what the extra complexity buys. With a real experiment: one quiet link failure, three designs, measured.
- VyOS firewall in depthIntermediate · 45 min
Build a complete VyOS firewall step by step: the input, forward and output hooks, a global state policy, groups, custom chains, protecting the router with rate-limited SSH, egress filtering, rule order, the ICMPv6 that IPv6 can't live without, and the nftables underneath.
- Two internet connections on DebianIntermediate · 45 min
Give a Debian office router a second ISP: a routing table per ISP, source rules and connection marks so replies leave the way they came, per-ISP NAT, and a systemd health check that fails over and back, measured with a real outage.