55

For my test environment i want to accept all incoming traffic, can someone please give me the iptable rule to be added.

My current iptables -L -n output looks like this

Chain INPUT (policy ACCEPT) target prot opt source
destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED ACCEPT icmp -- 0.0.0.0/0
0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 REJECT all -- 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-prohibited ACCEPT tcp -- 0.0.0.0/0
0.0.0.0/0 tcp dpt:8443 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9443 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2124

Chain FORWARD (policy ACCEPT) target prot opt source
destination REJECT all -- 0.0.0.0/0 0.0.0.0/0
reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT) target prot opt source
destination

Thanks

2 Answers 2

83

Run the following. It'll insert the rule at the top of your iptables and will allow all traffic unless subsequently handled by another rule.

iptables -I INPUT -j ACCEPT

You can also flush your entire iptables setup with the following:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X
iptables -t security -F
iptables -t security -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

If you flush it, you might want to run something like:

iptables -A INPUT -i lo -j ACCEPT -m comment --comment "Allow all loopback traffic"
iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT -m comment --comment "Drop all traffic to 127 that doesn't use lo"
iptables -A OUTPUT -j ACCEPT -m comment --comment "Accept all outgoing"
iptables -A INPUT -j ACCEPT -m comment --comment "Accept all incoming"
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow all incoming on established connections"
iptables -A INPUT -j REJECT -m comment --comment "Reject all incoming"
iptables -A FORWARD -j REJECT -m comment --comment "Reject all forwarded"

If you want to be a bit safer with your traffic, don't use the accept all incoming rule, or remove it with "iptables -D INPUT -j ACCEPT -m comment --comment "Accept all incoming"", and add more specific rules like:

iptables -I INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP"
iptables -I INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Allow HTTPS"
iptables -I INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT -m comment --comment "Allow SSH"
iptables -I INPUT -p tcp --dport 8071:8079 -j ACCEPT -m comment --comment "Allow torrents"

NOTE: They need to be above the 2 reject rules at the bottom, so use I to insert them at the top. Or if you're anal like me, use "iptables -nL --line-numbers" to get the line numbers, then use "iptables -I INPUT ..." to insert a rule at a specific line number.

Finally, save your work with:

iptables-save > /etc/network/iptables.rules #Or wherever your iptables.rules file is
2
  • 2
    This answer finally ended my pain. This answer addresses the question "how do I just make #@$#% iptables do what I want it to do and only what I want it to do" The only improvement I would recommend is adding an example of forwarding a port. (ie, from 80 to 8080 and 443 to 8443) I think 99% of the questions about iptables would be answered in 1 single post. Oct 1, 2014 at 18:41
  • A bit late getting back to this, but here it is. Redirecting traffic from one port to another: "iptables -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080". It's easy enough to adjust it to do whatever you want. The only requirement is that both ports must be open (via entries above this statement.) Enjoy! Jan 23, 2015 at 18:05
24

to accept all incoming traffic you can use following command , -P is to set default policy as accept

iptables -P INPUT ACCEPT  

if you do not require your previous rules just flush/remove them and then use above command.
to flush all rules use

iptables -F    

You must log in to answer this question.