How to Install Iptables on CentOS 7

Starting with CentOS 7, FirewallD replaces iptables as the default firewall management tool.

FirewallD is a complete firewall solution that can be controlled with a command-line utility called firewall-cmd. If you are more comfortable with the Iptables command line syntax, then you can disable FirewallD and go back to the classic iptables setup.

This tutorial will show you how to disable the FirewallD service and install iptables.

Prerequisites #

Before starting with the tutorial, make sure you are logged in as a user with sudo privileges .

Disable FirewallD #

To disable the FirewallD on your CentOS 7 system , follow these steps:

1. Type the following command to stop the FirewallD service:

   Terminal

   sudo systemctl stop firewalld

2. Disable the FirewallD service to start automatically on system boot:

   Terminal

   sudo systemctl disable firewalld

3. Mask the FirewallD service to prevent it from being started by another services:

   Terminal

   sudo systemctl mask --now firewalld

Install and Enable Iptables #

Perform the following steps to install Iptables on a CentOS 7 system:

1. Run the following command to install the iptables-service package from the CentOS repositories:

   Terminal

   sudo yum install iptables-services

2. Once the package is installed start the Iptables service:

   Terminal

   sudo systemctl start iptables
   sudo systemctl start ip6tables

3. Enable the Iptables service to start automatically on system boot:

   Terminal

   sudo systemctl enable iptables
   sudo systemctl enable ip6tables

4. Check the iptables service status with:

   Terminal

   sudo systemctl status iptables
   sudo systemctl status ip6tables

5. To check the current iptables rules use the following commands:

   Terminal

   sudo iptables -nvL
   sudo ip6tables -nvL

   By default only the SSH port 22 is open. The output should look something like this:

   output

   Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts bytes target     prot opt in     out     source               destination         
    5400 6736K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
       0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
       2   148 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
       3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
       0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited
   
   Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts bytes target     prot opt in     out     source               destination         
       0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited
   
   Chain OUTPUT (policy ACCEPT 4298 packets, 295K bytes)
    pkts bytes target     prot opt in     out     source               destination     

At this point, you have successfully enabled the iptables service and you can start building your firewall. The changes will persist after a reboot.

Conclusion #

In this tutorial, you learned how to disable the FirewallD service and install iptables.

If you have any questions or remarks, please leave a comment below.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page