Starting a Linux Firewall from Scratch

The first steps in getting started with iptables.


Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.


sam9's picture

ther eis probably a mistake in the file:
/sbin/iptables -A FORWARD -m state --state \

I will try to get my head

JohnstonS's picture

I will try to get my head around this and code my own little thing soon i think. Johnston @

It would work but not well setup.

Anonymous's picture

The method of setting up this firewall would probably work fine, but for a beginner's guide to setting up a firewall I think that this glossed over too many details and outright left some unanswered.

It looks like the author set up this firewall in this manner because he didn't have access to the router. Why else would you setup proxy arp instead of just routing the protected network to the firewall? He also refers to the untrusted segment of his network as public network, and then mentions that for some that would be the Internet. He used non-routable IP space behind his firewall but then didn't mention that if you also did this you would need to do NAT.

I like the article because it explained how to set up a Linux box to be a firewall with needing to install a GUI for it, but I think that it used a poor example for what a typical network layout would be.


Dinil Divakaran's picture

Yes, I did forget to mention the connection to the outside world properly. It can be either through a server with a global address running a squid, or even some technique using NAT - Sorry that I missed these points.

I was majorly referring to a large campus-kind-of network where one would like to protect his/her smaller LAN.

Excellent Writeup on IPTables

Austin's picture

Divakaran this is a very good write up on iptables,Good and very practical example for a small setup.

Is it possible to expand this article and to add transparent proxy server using squid , as in a small setup its very common to have a linux Router/Gateway with proxy server.


Thanks. I should have added

Dinil Divakaran's picture


I should have added those details here; I will try to come up with another one, as and when time permits.

One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix