Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OKay I started delving into networking yesterday and just setup my ubuntu server so I am a complete noob.

I want to ask what are the input/out/forward chains in iptables? Say I want to open port 22 for ssh access, would I need to use all 3 of these? or just one of two of them?

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT


share|improve this question
up vote 4 down vote accepted

INPUT: packets coming from the network and going to your server.
OUTPUT: packets originating from your server and going to the network.
FORWARD: packets forwarded by your server, if/when it acts as a router between different networks.

In order to allow SSH access to your server, you have to accept the traffic in the INPUT chain.

share|improve this answer
And, in fairness, you also need to allow the return-half packets to pass through the OUTPUT chain. – MadHatter Sep 4 '11 at 16:32
I see. So in the case if I want to set up a postgresql db server I would need to open up the INPUT and OUTPUT in the iptables as packets can come in and out? – bash- Sep 5 '11 at 5:20

You only need the first rule.

  • INPUT: filters packets destined for your server
  • OUTPUT: filters packets originating from your server
  • FORWARD: filters packets to server accessible by another NIC
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.