What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To protect traffic between servers with iptables, identify whether the packet is locally delivered or routed, allow the required connection and its return traffic, then make the forwarding policy deny by default. In the example below, only app01 (10.0.10.10) can open TCP connections to PostgreSQL on db01 (10.0.20.20) over port 5432. The rules are applied on the host that actually routes the packet, tested without ending your administrative session, and saved for reboot recovery.
What iptables controls
iptables is the userspace administration tool for Linux Netfilter. It evaluates packets in chains, and the correct chain depends on where the packet is going:
| Chain | Use it when | Typical example |
|---|---|---|
INPUT |
The destination is the firewall host itself. | Allow an administrator to SSH to the database server. |
OUTPUT |
The packet was generated locally by the firewall host. | Control connections initiated by that host. |
FORWARD |
The host routes the packet between another source and destination. | Allow an application server to reach a database server through a router or firewall. |
A rule in FORWARD cannot permit traffic that is actually delivered to the firewall host. Conversely, an INPUT rule on a database host does not control a packet that passes through a separate routing firewall. Draw the path first and place rules on the system that sees the packet in the relevant hook.
Stateful matching and connection direction
Netfilter connection tracking can distinguish NEW, ESTABLISHED, RELATED, INVALID, and UNTRACKED states. A common stateful design accepts established replies before allowing a narrowly defined new connection. That means a database reply can return to the application without opening a second broad rule in the reverse direction.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
State tracking is not a substitute for a service rule: the first packet still needs a NEW rule that matches the intended source, destination, protocol, and port. Treat INVALID traffic separately if you need to log or reject it; do not assume that every packet belongs to a valid tracked flow.
Plan the path before writing a rule
Record the five values that determine a match
- Source: the actual address of the initiating server, not merely the subnet you expect it to use.
- Destination: the address assigned to the service host.
- Interface: the ingress and egress interfaces on the filtering host.
- Protocol and port: for example, TCP destination port
5432for PostgreSQL. - Delivery type: local delivery through
INPUT, local generation throughOUTPUT, or routing throughFORWARD.
For a routed design, verify that the firewall has a route to both networks, the application host uses the firewall as its path to the database, and the database has a return route. A syntactically correct rule cannot repair an asymmetric or missing route.
Recommended Free Tools
Example topology
Assume a firewall host named fw01 routes between an application network and a database network:
| Host | Address | Role |
|---|---|---|
app01 |
10.0.10.10 |
Client that must initiate PostgreSQL connections |
db01 |
10.0.20.20 |
Server listening on TCP port 5432 |
fw01 |
Interfaces on both networks | Routes and filters the packet |
If app01 and db01 are on the same network and communicate directly, their packets normally do not traverse fw01; a FORWARD rule on fw01 will never see them. If the firewall host is itself db01, use INPUT on that host instead.
Check whether forwarding is enabled
Linux must be configured to route packets for a routed firewall. Check the IPv4 setting before troubleshooting rules:
sysctl net.ipv4.ip_forwardIf the value is 0 and this host is intended to route traffic, enable it for the current boot with:
sudo sysctl -w net.ipv4.ip_forward=1Persist the setting using your distribution’s normal sysctl configuration method. IPv6 forwarding is a separate setting, and IPv6 traffic needs IPv6 rules; an IPv4 policy does not protect it automatically.
Identify the active firewall manager
Modern distributions can present iptables syntax while implementing rules through nftables. Ubuntu documents nftables as the successor to the iptables component; Debian has used nftables as the default backend since Debian 10 Buster; and Red Hat documents iptables operating through the nf_tables API. The command name alone does not tell you which ruleset is active.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Inspect the host before changing anything:
sudo iptables -V
sudo iptables -S
sudo iptables -L -n -v
sudo nft list ruleset
sudo ufw status
sudo firewall-cmd --stateRun the checks that apply to your system. The output from iptables -V commonly identifies an nftables-backed or legacy implementation, while nft list ruleset shows the native rules currently loaded. A host may also have a simpler frontend or a zone-based manager enabled.
Choose one owner for the hooks you are changing. Do not alternately edit the same policy with direct iptables commands, nftables files, a zone manager, and a frontend without understanding how they interact. Multiple managers can install rules in different chains, reorder decisions, or replace your changes at reload or reboot.
Protect your administrative access first
Make changes from an existing root-capable session and keep a second session, a hypervisor console, or another out-of-band recovery path available. A remote default-drop policy can terminate the only connection you have.
Before changing a default policy, ensure the following are present and in the correct order:
- Loopback traffic is accepted.
- Replies to already established management connections are accepted.
- A new SSH rule is limited to the administrator’s known source address and, where possible, the management interface.
- Console or scheduled rollback access has been tested.
For example, adapt ADMIN_IP and the interface name to your environment:
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp -s ADMIN_IP --dport 22 -m conntrack --ctstate NEW -j ACCEPTDo not copy these commands unchanged. If an existing chain already contains equivalent rules, adding duplicates makes later auditing harder. Review the current policy and counters first, and do not flush an unfamiliar ruleset just to start over.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Build a least-privilege FORWARD policy
The following sequence is an illustrative IPv4 pattern for the topology above. It permits only new TCP connections from 10.0.10.10 to 10.0.20.20:5432, while allowing replies to tracked connections. Replace addresses, interfaces, and ports with values from your own path.
1. Inspect the current rules and counters
sudo iptables -S
sudo iptables -L -n -vThe verbose listing shows packet and byte counters. Those counters are useful after each test: a zero counter usually means the packet did not reach that rule, matched a different rule first, or took a different chain.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
2. Allow loopback and established forwarding
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTPlace the established-state rule before the new-flow rule. It covers return packets in either direction after the initial connection is tracked. Keep the management rule on INPUT; it is unrelated to application-to-database forwarding.
3. Permit only the required new flow
sudo iptables -A FORWARD -s 10.0.10.10 -d 10.0.20.20 -p tcp --dport 5432 -m conntrack --ctstate NEW -j ACCEPTThis rule does not allow the application server to reach every port on the database, and it does not allow other application hosts to use PostgreSQL. Add interface constraints when they are stable and meaningful:
sudo iptables -A FORWARD -i APP_IF -o DB_IF -s 10.0.10.10 -d 10.0.20.20 -p tcp --dport 5432 -m conntrack --ctstate NEW -j ACCEPTInterface matching narrows the path but also creates an operational dependency: renaming a network interface or changing the route can make an otherwise correct rule stop matching.
4. Make forwarding deny by default
sudo iptables -P FORWARD DROPSet the default only after verifying that required management and established-state rules are in place. A default DROP on FORWARD blocks every routed flow not explicitly accepted, including DNS, monitoring, software updates, and other dependencies you may not have inventoried. Add each required service deliberately rather than broadening the policy to ACCEPT.
Optional drop logging
Counters tell you that packets were evaluated, but a rate-limited log can show which addresses and interfaces are being denied. Add a logging rule near the end of the FORWARD chain, before the chain’s default drop takes effect:
sudo iptables -A FORWARD -m limit --limit 5/min -j LOG --log-prefix 'iptables-forward-drop ' --log-level 4Use a conservative rate. Logging every packet can fill local logs and obscure the event you need. The logging rule records a packet and then returns to normal chain processing, so the default DROP still denies it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteTest the policy without guessing
Test the permitted direction
From app01, connect to the database address and port using the application’s normal client or a controlled TCP test. Confirm that the connection succeeds only when the database is listening and its own host firewall and service access controls also permit it. Then inspect counters on fw01:
sudo iptables -L FORWARD -n -v --line-numbersThe specific allow rule should increment. The established-state rule should increment when reply packets return. A successful TCP handshake proves that the network path and filtering decision worked; it does not prove that database authentication or authorization is correctly configured.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Test expected failures
- Try the same port from an unauthorized source address; it should be denied by the forwarding policy.
- Try a different destination port from
app01; it should be denied unless another existing rule allows it. - Try the database port in the reverse direction; a new connection should not be accepted merely because the forward direction is allowed.
- Check that an existing SSH session remains usable before and after policy changes.
Run failure tests from the actual source hosts. A test launched on fw01 exercises OUTPUT, not FORWARD, and can produce a misleading result.
Why a FORWARD rule may not work
The packet is using another chain
If the destination is the firewall itself, inspect INPUT. If the firewall initiates the connection, inspect OUTPUT. If the servers communicate directly without routing through the host, no rule on that host will match.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Forwarding or routing is missing
Check the route on both servers, the firewall’s interfaces, and the forwarding sysctl. A packet that never reaches the filtering host cannot increment an iptables counter. The database must also have a return path; stateful tracking cannot create one.
A previous rule wins
Rules are evaluated in order. A broad earlier DROP, REJECT, or jump to a custom chain can prevent the intended rule from being reached. Conversely, an earlier broad ACCEPT can allow more traffic than your new rule appears to permit. Use numbered listings and inspect referenced chains:
sudo iptables -L FORWARD -n -v --line-numbers
sudo iptables -SThe source or interface does not match
Addresses can change because of multiple interfaces, routing, translation, or failover. Confirm the source address seen on the firewall and verify that -i, -o, protocol, and destination port match the real packet. Remove an interface constraint temporarily only as a controlled diagnostic, then restore the narrow rule.
Return traffic is blocked
Without an ESTABLISHED,RELATED rule, the initial SYN may be accepted while replies are dropped. Place the return-state rule before the new-flow rule and check its counters during a connection attempt.
You are inspecting the wrong backend
An nftables-backed iptables command and a legacy ruleset are not interchangeable. On Ubuntu, Debian, and Red Hat systems, determine whether the active commands use nftables and inspect the native ruleset when necessary. Avoid loading a second framework that controls the same hooks.
The traffic is IPv6
iptables rules cover IPv4. If name resolution or application configuration selects an IPv6 address, create and test the corresponding ip6tables policy, including forwarding and established-state handling, or explicitly disable the unintended path according to your network design.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Another service rewrites the rules
Zone managers, frontends, virtualization platforms, and container systems may create chains or reload rules. Record the owner identified during inventory, make the change through that owner when appropriate, and test after its reload operation. A rule that works until a service restart is a persistence or ownership problem, not a packet-matching mystery.
Save, test, and restore the rules
Running commands changes the in-memory ruleset. Reboot behavior depends on the distribution and the persistence mechanism installed on that host. Export a known-good ruleset after testing:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo iptables-save > /root/iptables.rules.v4iptables-save can write a selected table or all available tables. Protect the file because it contains the host’s firewall policy and may reveal internal addresses.
To load a reviewed file into the running IPv4 ruleset:
sudo iptables-restore < /root/iptables.rules.v4Use your distribution’s documented persistence service or package to install the file for boot. File names and boot integration differ, so do not assume that saving under /root alone makes rules persistent. Debian’s documented workflow is to prepare and test a rules file, restore it for verification, and only then make it the master configuration.
Plan a rollback before a remote change
- Export the current working ruleset to a separate, timestamped file.
- Keep a console or second privileged session open.
- Apply one logical change at a time.
- Test SSH, the permitted application flow, and an expected denial.
- If access fails, restore the known-good file from the console or execute a previously scheduled rollback.
Do not overwrite your only backup with an untested ruleset. Reboot testing is part of the change: verify that the intended backend loads the same policy and that no manager replaces it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →IPv4, IPv6, and modern alternatives
Direct iptables commands remain useful when you need precise, immediate rules and your team already operates them. The surrounding tool determines how forwarding, state handling, persistence, and ownership are expressed.
| Approach | Rule granularity | Forwarding or zone policy | State and address families | Persistence and operational risk |
|---|---|---|---|---|
| Direct iptables | Fine-grained matches for addresses, interfaces, protocols, ports, and conntrack states. | FORWARD is explicit; zone concepts are not built in. |
Stateful matching is available; IPv4 and IPv6 require separate command families. | Save and restore explicitly or use the distribution’s persistence integration. Risk increases if another manager also edits the hooks. |
| Native nftables | Fine-grained rules with sets and native rule organization. | Forwarding and filtering are modeled directly in nftables chains. | IPv4 and IPv6 can be handled in one native ruleset. | Use one nftables configuration owner and its boot integration; inspect with nft list ruleset. |
| Ubuntu’s ufw | Simpler service and address rules, with less direct control of complex policies. | Suitable for common host policies; advanced routed designs may need explicit lower-level rules. | Supports the address families and state behavior exposed by its configuration. | Convenient for Ubuntu hosts, but direct iptables edits can conflict with the frontend’s reload behavior. |
| firewalld | Rules organized through zones and policies. | Zone-to-zone forwarding and policy concepts are first-class. | Stateful filtering and IPv4/IPv6 management are exposed through the zone model. | Make persistent changes through firewalld when it owns the host; direct edits may disappear on reload. |
Ubuntu identifies ufw as its default firewall configuration tool, while nftables is the successor to the iptables component. Debian’s nftables default backend and Red Hat’s nf_tables API mean that an iptables command may be a compatibility interface rather than a separate legacy firewall. For a new deployment, choose the tool that matches your distribution, team ownership, forwarding complexity, rollback process, and IPv4/IPv6 requirements instead of mixing frameworks by habit.
Quick Recap
Operational checklist
- Map the real source, destination, route, interfaces, protocol, and port.
- Confirm whether the packet uses
INPUT,OUTPUT, orFORWARD. - Identify the active backend and any frontend or zone manager before editing.
- Keep console or second-session access while changing a remote firewall.
- Allow loopback and established management traffic before tightening defaults.
- Use a source-specific, destination-specific, protocol-specific new-flow rule.
- Place
ESTABLISHED,RELATEDhandling before new-flow rules. - Set
FORWARDtoDROPonly after required flows and management access are verified. - Use counters and limited logging to observe matches and denials.
- Test permitted traffic, unauthorized sources, wrong ports, reverse initiation, IPv6, and reboot behavior.
- Export a known-good ruleset with
iptables-saveand document how to restore it. - Ensure one framework owns the hooks and that persistence is tested after service reload and reboot.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
