• Check it out - we have a chatbot! Go ask TuxBot a question in the Ask Tuxbot section!

Problem with iptables on Debian 11


New Member
Nov 10, 2020
Reaction score
First necessary information:
uname -a
Linux debian2 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 GNU/Linux
dpkg -l | grep netfilter-persistent
ii  netfilter-persistent                  1.0.15                           all          boot-time loader for netfilter configuration
[email protected]:~$ update-alternatives --list iptables
Now, iptables rules:

echo "Starting Firewall..."

iptables -F
iptables -F -t nat
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

conntrack -F

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m conntrack --ctstate NEW,INVALID -j LOG --log-prefix "ininvalid: "

iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -A PREROUTING -f -j DROP
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

#iptables - A INPUT -m state --state INVALID -j LOG --log-prefix "ininvalid: "
# --log-level 4

# tylko sync
iptables - A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP

iptables -A INPUT -p tcp --dport 137 -j DROP
iptables -A INPUT -p udp --dport 137 -j DROP
iptables -A INPUT -p tcp --dport 138 -j DROP
iptables -A INPUT -p udp --dport 138 -j DROP
iptables -A INPUT -p tcp --dport 445 -j DROP
iptables -A INPUT -p udp --dport 445 -j DROP

iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP

iptables -A OUTPUT -m conntrack --ctstate NEW,INVALID -j LOG --log-prefix "outinvalid: "

iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix "outinvalid: " --log-level 4

iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP

iptables -A OUTPUT -p icmp -m icmp --icmp-type 0 -j DROP

# Drop everything else
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP
It does not mean which way I tray to set up firewall, I always get a message
iptables-restore: line 2 failed

What this message means, Google have no answer..

Last edited:
MALIBAL Linux Laptops

Linux Laptops Custom Built for You
MALIBAL is an innovative computer manufacturer that produces high-performance, custom laptops for Linux.

For more info, visit: https://www.malibal.com

Members online

Latest posts