1

I would like to temporarily add the following iptables rule to see if allowing inbound traffic on port 5000 I will be able to connect to my docker container and the web server running within it:

$ sudo iptables -A INPUT -p tcp --dport 5000 -m state --state NEW -j ACCEPT

Then, if this attempt is unsuccessful, I would remove the above rule, but I do not know how to do it.
I use iptables-persistent and, as suggested by dokku documentation, I do not use ufw.

2

Append vs Insert

Before I answer the question, let's look at the structure of the command:

iptables -A INPUT 'the rule'

That means iptables -Append at the end of the INPUT chain the following rule. The other common way to add a rule to iptables is by the insert option:

iptables -I INPUT 'the rule'

That means iptables -Iinsert at the beginning of the INPUT chain the following rule. Or when we want to insert the rule at certain place, for example before some existing rule that is number 3 in the chain:

iptables -I INPUT 3 'the rule'


The Numbers of the Rules

The numbers of the rules play significant role in iptables (ipchain). As illustration - let's say we have the following structure of rules:

1. Deny all UDP 
2. Allow UDP on port 456

The UDP shouldn't be allowed on port 456, because it is already denied for all ports, so the structure must be:

1. Allow UDP on port 456
2. Deny all (rest) UDP 

If you want to read the structure of the chain INPUT use:

sudo iptables -S INPUT

If you need to get the numbers of the rules, then you can use the command:

sudo iptables -L INPUT -n --line-numbers # you can omit '-n'


The Answer

In order to delete some rule from a known chain, you can use the command:

iptables -D CHAIN_NAME 'the rule'

That means iptables -Delete from CHAIN_NAME the following rule. Or in your case the command should be:

sudo iptables -D INPUT -p tcp --dport 5000 -m state --state NEW -j ACCEPT

Also, you can delete the rule by its number within the chain, let's say it is number 3:

sudo iptables -D INPUT 3


As conclusion

I'm sharing the opinion that, the tool Uncomplicated firewall - ufw, that is front-end of iptables, - sometimes can make the things much more complicated as they actally are :)

Here is a good article, provided by DigitalOcean, that describes the same as this answer, but in more details: How To List and Delete Iptables Firewall Rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.