group iptables rules in chain

When managing multiple firewall rules for a specific application, service, or policy, adding them directly to default chains (like INPUT, FORWARD, or PREROUTING) makes bulk updates and cleanups difficult. If you need to remove or disable that policy later, you would normally have to delete every single rule one by one.

The cleanest solution in iptables is to create a custom user-defined chain. By grouping related rules inside their own chain and linking that chain to a default table, you can enable, disable, or flush all associated rules in a single command.

---

The Problem: Cluttered Default Chains

Consider applying several packet-marking or filtering rules for a specific service across different hooks:

iptables -t mangle -A PREROUTING -p udp --dport 4444 -j MARK --set-mark 100
iptables -t mangle -A INPUT -p udp --dport 4444 -j MARK --set-mark 100
iptables -t mangle -A OUTPUT -p udp --dport 4444 -j MARK --set-mark 200

Deleting these later requires referencing each specific rule line or rule number individually, which is tedious and error-prone in production environments.

---

The Solution: Group Rules into a Custom Chain

Step 1: Create the Custom Chain in the Target Table

Create a custom chain (e.g., MYCHAIN). Remember that user-defined chains exist only within the specific table where they are created (e.g., mangle, filter, or nat):

# Create MYCHAIN inside the mangle table
iptables -t mangle -N MYCHAIN

Step 2: Add Rules into Your Custom Chain

Populate your chain with the relevant match criteria and actions:

iptables -t mangle -A MYCHAIN -p udp --dport 4444 -j MARK --set-mark 100
iptables -t mangle -A MYCHAIN -p udp --sport 4444 -j MARK --set-mark 200

Step 3: Link Your Custom Chain to Built-in Chains

To make the rules active, direct traffic from the standard hooks (such as PREROUTING or INPUT) into your custom chain:

iptables -t mangle -A PREROUTING -j MYCHAIN
iptables -t mangle -A OUTPUT -j MYCHAIN

---

How to Easily Manage and Delete the Group

When you need to clear or completely remove the rule group, the workflow is clean and immediate:

1. Unlink the Chain: Remove the single jump rule from the built-in chains:

   iptables -t mangle -D PREROUTING -j MYCHAIN
   iptables -t mangle -D OUTPUT -j MYCHAIN

2. Flush the Rules: Clear all rules inside your custom chain in one step:

   iptables -t mangle -F MYCHAIN

3. Delete the Empty Chain: Remove the custom chain definition:

   iptables -t mangle -X MYCHAIN

How to block incoming Russian IP addresses in the iptables by user defined chain

Too much attack/scanning to the server. Try to block all incoming Russian IP addresses in the iptables.

1. First find generate the ACL list from:
https://www.countryipblocks.net/acl.php It gives me a total # of 24,445 line of ip address range at the time.
2. Replace the iptables string for user-defined chain:

iptables

by

iptables -A chain-Russian-Block



Run the command to make create the chain:

iptables -N chain-Russian-Block
...
iptables -A chain-Russian-Block -s 2.56.24.0/23 -j DROP
iptables -A chain-Russian-Block -s 2.56.26.0/23 -j DROP
iptables -A chain-Russian-Block -s 2.56.88.0/22 -j DROP
...
iptables -A INPUT -j chain-Russian-Block

Check total lines of rules in the chain:

# iptables -S chain-Russian-Block | wc -l
24,445

Save it for reboot.

service netfilter-persistent save

Disable CentOS 7 Firewalld replace by iptables

CentOS/RHEL 7 came with the new firewall called Firewalld.

It is bit complicated for me, as I am using iptables firewall from many years. The best part: all Linux came with it and you can use same scrip everywhere.

1. First Disalbe Firewalld



systemctl stop firewalld
systemctl disable firewalld



2. Uninstall it if you are more comfort with iptables



yum erase firewalld



3. Install iptables service



yum install iptables-services



4. Enable it in systemd



systemctl start iptables
systemctl enable iptables



5. Apply some basic rules



iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Accept packets from trusted IP addresses
iptables -A INPUT -s [MY_IP] -j ACCEPT
iptables -A OUTPUT -d [MY_IP] -j ACCEPT

# Accept local nic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Accept port 80
iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 80 -j ACCEPT

# Allow full outgoing connection but no incomming stuff
iptables -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT



6. Save changes

Please notice the old "service iptables save" does not work anymore.
Please use this command to save the changes:


iptables-save > /etc/sysconfig/iptables

How to protect your web site by iptables on CentOS RHEL OEL

# Fist Cleaning all rules
iptables -F
iptables -X

# By default I drop all traffic
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Only allow ssh and web
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 80 -j ACCEPT

# Allow lo
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Save the config for reboot and restart the service see how it works.
service iptables save
service iptables restart

More safe if you have a static IP:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s [My Static IP]/32 -d [Server IP]/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s [Server IP]/32 -d [My Static IP]/32 -p tcp -m tcp --sport 22 -j ACCEPT

More safe if you Only talk to another server:

-A INPUT -s [Another Server]/32 -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -d [Another Server]/32 -p tcp -m tcp --dport 80 -j ACCEPT

If you want allow ssh from other subnet:

-A INPUT -s 192.168.244.0/24 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A OUTPUT -d 192.168.244.0/24 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT

Enable DNS:

iptables -A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT

Enable yum:

iptables -A OUTPUT -m tcp -p tcp -m state --state NEW -m multiport --dports 80,443 -j ACCEPT