Set up a firewall on Debian 9 using iptables
Iptables is the default firewall tool in older Debian distributions.
Having a functional firewall on the server is an essential step in security work. In this guide, we will create a basic firewall that you can later extend with your own rules. The guide assumes a newly installed Cloud VM running Debian 9. If you want to set up a firewall on Debian 11 or newer, we have a guide for that here: "Set up a firewall on Debian 11 or newer using nftables".
In this guide, we show you how to configure a firewall using iptables, which is typically included by default in older Debian releases.
Install the firewall service
To get started, you need to install the packages iptables-persistent and netfilter-persistent if you haven’t done so already. These allow you to save your rules and have them applied automatically at boot.
Start by updating the package repository:
apt updateInstallera iptables och netfilter-persistent med följande kommando:
apt install netfilter-persistent iptables-persistentDuring the installation, you will be asked whether you want to save the generated rules. Choose yes here. We will edit the rules shortly thereafter.
Create firewall rules
To get started as quickly as possible, we’ll copy and paste pre‑written firewall rules. Later in the guide, we’ll show you how to add new rules.
To add the firewall rules, edit the files /etc/iptables/rules.v4 and /etc/iptables/rules.v6 for IPv4 and IPv6 respectively.
Open the rules.v4 file in your text editor (use sudo if you’re not root).
nano /etc/iptables/rules.v4The file that opens contains something similar to this:
Replace this with the following configuration. Be sure to insert your server’s IP address wherever it says <THE SERVER IPv4 ADDRESS>:
Save and close the file.
Restart netfilter-persistent to load the configuration (use sudo if you're not root):
Verify that iptables has loaded the configuration:
You should get an output similar to this:
We have now saved the rules in the file /etc/iptables/rules.v4, allowing iptables to use them.
Using the rules above, we permit incoming traffic for traceroute, ICMP (PING), SSH, HTTP, and HTTPS, and outgoing traffic for traceroute, HTTP, and HTTPS.
Thanks to iptables-persistent and netfilter-persistent, these settings will be loaded each time you reboot the server.
Adding rules for IPv6
If your server also has an IPv6 address, add the rules in the same way as above, but edit the file /etc/iptables/rules.v6. Be sure to replace <THE SERVER IPv6 ADDRESS> with your actual IP address.
Restart netfilter-persistent to load the configuration (use sudo if you're not root):
Add rules using the command line
You can add new rules either by editing /etc/iptables/rules.v4 or by inserting the rule directly from the command line.
In this example, we add a rule that allows outbound traffic on port 25 (SMTP) via the command line.
Enter the following (add sudo if you're not root):
Verify that the rule was added by running:
In the output you receive, you can see that the rule has been added (see the last line):
Save the firewall settings by running the following command:
When the server restarts, the settings will be loaded from /etc/iptables/rules.v4.
Summary
By following this guide—either by pasting your firewall rules directly into the configuration file or manually via commands—you’ll have a solid basic firewall setup. You’ll still need to add individual rules for each service you want to allow access to.
Note: When working with firewalls, be careful not to lock yourself out of the server by blocking SSH traffic (port 22 by default). If you lose access due to firewall settings, you may need to connect through the console to regain access. Once you’re connected via the console, you can modify your firewall rules to re‑allow SSH (or permit all traffic). If your saved firewall rules already allow SSH access, another option is simply to reboot the server. See our guide on how to reach your server via console mode.
Last updated
Was this helpful?