reveal // what a firewall is

a firewall sounds like a fortress. most of the time it's a screen door

everyone assumes their firewall is doing something. you set it up once, maybe years ago, maybe some setup script did it for you, and you just trust it's blocking the bad stuff and letting the good stuff through. but "having a firewall" and "knowing what your firewall actually allows" are two completely different things. one is a vibe. the other is a fact you can check in about two seconds.

the command

iptables -L INPUT -n --line-numbers

this lists every rule in the INPUT chain, which is the set of rules that decides what traffic is allowed to reach your machine from the outside. no reverse dns lookups slowing things down, no guessing, just the raw rules in the order they're actually evaluated.

breaking down the flags

-L INPUT tells iptables to list the rules specifically in the INPUT chain, which is the one that matters for "what can reach this box." there are other chains too, OUTPUT for traffic leaving the machine and FORWARD for traffic passing through it, but INPUT is your front door.

-n means numeric. it stops iptables from resolving ip addresses and ports into hostnames and service names. sounds like a small thing but it makes the output load instantly instead of hanging while it tries to do dns lookups on every rule. it also just shows you the truth, raw ports and ips, no interpretation.

--line-numbers adds a number next to each rule. this matters because iptables rules are processed top to bottom, first match wins. if you ever need to delete or insert a rule at a specific spot, you need that number. without it you're just guessing.

why order is the whole game

a lot of people read their firewall rules like a checklist, as in "is this rule in there somewhere." that's not how iptables works. it goes through the list top to bottom and the first rule that matches your traffic decides what happens. everything after that is irrelevant for that packet.

so you can have a solid DROP rule for a sketchy port sitting at position 12, and a wide open ACCEPT rule sitting at position 3 that already let the traffic through before it ever got to your good rule. the firewall isn't broken, it's just not doing what you assumed it was doing. this is the single most common reason people think they're locked down when they're not.

what you're actually looking for

when you run the command, scan for a few specific things. first, any ACCEPT rule with a source of 0.0.0.0/0, which means "any ip on the internet." that's fine for something like port 443 if you're running a public website, but it's a real problem if it's sitting on your ssh port or a database port that should only be reachable from your own network or a vpn.

second, check what the default policy is doing at the bottom. if you don't see an explicit DROP or REJECT as the final catch-all, unmatched traffic might be falling through to ACCEPT by default, which defeats the entire purpose of having rules in the first place.

third, look for duplicate or conflicting rules. it's common to find leftover rules from some old setup script, a tutorial you followed two years ago, or a docker install that quietly punched its own holes in the chain. iptables doesn't clean up after itself, you have to.

fixing what you find

if you spot a rule you don't want, use the line number you now have to remove it cleanly:

iptables -D INPUT 5

that deletes rule number 5 in the INPUT chain. if you want to insert a tighter rule above a loose one, use -I with a position number instead of appending to the bottom where it'll never get evaluated first. and always test changes on a system you have physical or console access to, since a bad firewall rule can lock you out of your own ssh session in about half a second.

the takeaway

a firewall isn't a magic shield you install once and forget. it's a list of rules that only protects you if the rules are actually tight and actually in the right order. run iptables -L INPUT -n --line-numbers on your own servers today, read it top to bottom like it's evaluating real traffic, because it is, and tighten anything that's wide open when it shouldn't be. two seconds of checking beats finding out the hard way that your fortress had an open door the whole time.