This is how I run iptables on a sufficiently large network of machines. The advice is not complete. IPv6 is real and really works most of the time these days.

This is how I run iptables on a sufficiently large network of machines. The advice is not complete. IPv6 is real and really works most of the time these days. Back up your ip6tables to a file too. I like /etc/firewall-4.conf and /etc/firewall-6.conf but it's down to preference. Know about iptables-apply too, lest you be caught unaware.