# IPTables Example Configuration

**URL:** <https://forum.networklessons.com/t/iptables-example-configuration/1074>\
**Category:** Lessons Discussion\
**Created:** [December 26, 2016, 7:17pm UTC](https://forum.networklessons.com/t/iptables-example-configuration/1074 "2016-12-26T19:17:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\
**Post date:** [December 26, 2016, 7:17pm UTC](https://forum.networklessons.com/t/iptables-example-configuration/1074/1 "2016-12-26T19:17:26Z")

</div>

This topic is to discuss the following lesson:

> **[IPTables Example Configuration](https://networklessons.com/miscellaneous/iptables-example-configuration)**
>
> This tutorial explains some best practices and examples for IPTables.

---

<div class="post-metadata">

**Author:** ![system](https://cdn-forum.networklessons.com/uploads/default/original/1X/1d2ef66728c7fbac8377748594345a3f474fce5f.png) [@system](https://forum.networklessons.com/u/system)\
**Post date:** [February 19, 2014, 7:16pm UTC](https://forum.networklessons.com/t/iptables-example-configuration/1074/2 "2014-02-19T19:16:21Z")

</div>

Nice work!  
One thing though, I have a feeling some ACCEPT rules should probably be before DROP.  
For example:  
-A INPUT -i lo -j ACCEPT should sit before filtering Spoofed Packets… I think.  
Maybe I’m just messing with my own head right now 😉

---

<div class="post-metadata">

**Author:** ![system](https://cdn-forum.networklessons.com/uploads/default/original/1X/1d2ef66728c7fbac8377748594345a3f474fce5f.png) [@system](https://forum.networklessons.com/u/system)\
**Post date:** [July 20, 2014, 6:05pm UTC](https://forum.networklessons.com/t/iptables-example-configuration/1074/3 "2014-07-20T18:05:40Z")

</div>

I agree with Pavel, you need to have the lo interface accept before blocking packets that have localhost addresses!  
Also this doesn’t seem right:  
-A INPUT -p tcp -m state --state NEW -m limit --limit 50/second --limit-burst 50 -j ACCEPT  
This will immediately accept all SYN packets as long as they don’t breach the rate limit, therefore all of the later checks will be bypassed by such packets.

---

<div class="post-metadata">

**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\
**Post date:** [August 6, 2014, 11:34am UTC](https://forum.networklessons.com/t/iptables-example-configuration/1074/4 "2014-08-06T11:34:47Z")

</div>

Hi Pavel,

That does make sense, just changed it…thanks!

Rene

---

<div class="post-metadata">

**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\
**Post date:** [August 6, 2014, 11:35am UTC](https://forum.networklessons.com/t/iptables-example-configuration/1074/5 "2014-08-06T11:35:12Z")

</div>

Hi Ben,

Thanks for sharing this, I just changed it. If you have other ideas feel free to share 🙂

Rene