Linux iptables: Inspect Rules and Plan Changes Safely

iptables is a command-line interface to Linux packet-filtering rules. Before editing a server firewall, find out which tool manages the rules and whether the system uses the nftables compatibility layer. A hand-entered rule can conflict with UFW, firewalld or automation that later replaces the ruleset.

Read the current rules first

sudo iptables -S
sudo iptables -L -n -v

The first command prints rules in a form that is easier to review; the second shows chains, counters and packet/byte activity. Check IPv6 separately with ip6tables where it is in use. A zero counter does not by itself prove that a rule is unnecessary; the observation window may be short.

Identify default policies, chain order and the service owner before changing anything. Rules are evaluated in order, and an early accept or drop can make later entries irrelevant. The iptables manual documents options and compatibility details.

Protect remote access during a change

On a remote-only host, verify console access or a scheduled rollback before modifying input policy. Allow the real SSH port and trusted source range before restricting other traffic, then test a second connection. Do not rely on the session that is already open; established connections can remain alive after new connections are blocked.

Prefer changing rules through the firewall manager already responsible for the host. If a direct change is needed, capture the current configuration and define how it will persist after a restart. An interactive rule that disappears on reboot is not the same as a maintained firewall policy.

Verify the effect

Check both IPv4 and IPv6 exposure, test intended services from the appropriate network and inspect counters again. Remove temporary exceptions after the maintenance task. If the machine uses a higher-level manager, make the lasting change there so that the next service reload does not silently undo it.