@@ -65,7 +65,9 @@ tidy:
 ## Every backend is covered: the ufw demo for the shared screens, the firewalld
 ## one for the zone view and the actions menu that only it has, and the
 ## nftables one for the router screens — the flow rule list, the NAT and alias
-## views, the phase-2 add form and the staged atomic apply.
+## views, the phase-2 add form and the staged atomic apply — and the iptables
+## one for the cloud-image screens: the insert before the catch-all REJECT and
+## the persist diff.
 screenshots: build
 	python3 $(KIT)/tools/render-screenshots.py \
 		--bin $(BIN)/$(TOOL) --name $(TOOL) --out docs/screenshots \
@@ -86,6 +88,12 @@ screenshots: build
 		--bin $(BIN)/$(TOOL) --name $(TOOL) --out docs/screenshots \
 		--args="--demo=nftables" --settle 1.0 --budget 7.0 \
 		--screen nftables-live=w
+	python3 $(KIT)/tools/render-screenshots.py \
+		--bin $(BIN)/$(TOOL) --name $(TOOL) --out docs/screenshots \
+		--args="--demo=iptables" \
+		--screen iptables= \
+		--screen 'iptables-add=a\t51820\t\rudp\r\t\r' \
+		--screen 'iptables-persist=a\t51820\t\rudp\r\t\ryW'
 
 ## readme: regenerate the generated README sections from tool.json.
 readme:
 
@@ -7,7 +7,7 @@
 > and keys may move without notice until 1.0. Pin versions, and report what
 > breaks.
 
-A terminal UI for the Linux firewall — **ufw**, **firewalld** and **nftables** —
+A terminal UI for the Linux firewall — **ufw**, **firewalld**, **iptables** and **nftables** —
 that shows the rules you actually have and **previews the exact command line of
 every change before running it**.
 
@@ -16,9 +16,10 @@ fills the gap on a server or a tiling desktop, in the
 [Omarchy](https://omarchy.org) visual style. It picks the backend your machine
 actually runs, and the screen is built from what that backend can do — one rule
 list and three default policies for ufw, one group per zone with its target for
-firewalld, and for a machine neither of them manages, the raw nftables ruleset
-read straight from `nft`: filter chains by hook, a NAT view, and named sets as
-aliases.
+firewalld, the iptables chains of a cloud image whose rules are restored at boot
+by iptables-persistent, and for a machine none of them manages, the raw nftables
+ruleset read straight from `nft`: filter chains by hook, a NAT view, and named
+sets as aliases.
 
 ![Rules table](docs/screenshots/tui-firewall-main.png)
 
@@ -189,12 +190,13 @@ you quit.
 ```sh
 tui-firewall --demo             # an in-memory ufw
 tui-firewall --demo=firewalld   # an in-memory firewalld
+tui-firewall --demo=iptables    # a cloud image: INPUT ends in a REJECT, docker chains
 tui-firewall --demo=nftables    # a sample router ruleset
 ```
 
 `--demo` runs against an in-memory sample firewall. Every key works, every
 command is built and previewed for real, and nothing touches your system. The
-three demos are the three real backends over fake output, not three skins: each
+four demos are the four real backends over fake output, not four skins: each
 one parses backend-shaped output with the same parser and builds its commands
 with the same builder. The nftables demo starts from a router ruleset — filter
 chains for input, forward and output, the two NAT chains, and the named sets the
@@ -214,11 +216,13 @@ is what executes.
 tui-firewall                      # drive the real firewall
 tui-firewall --demo               # sample ufw data, no privileges needed
 tui-firewall --demo=firewalld     # sample firewalld data
+tui-firewall --demo=iptables      # sample cloud-image iptables
 tui-firewall --demo=nftables      # sample router ruleset
 tui-firewall --check              # read the firewall, print JSON, exit
 tui-firewall --report             # print what a bug report needs, exit
 tui-firewall --backend ufw        # skip autodetection
 tui-firewall --backend firewalld
+tui-firewall --backend iptables
 tui-firewall --backend nftables
 tui-firewall --theme ~/mytheme/colors.toml
 tui-firewall --sudo ""            # run the firewall command directly (as root)
@@ -315,11 +319,12 @@ firewall nor `sudo` is available, it says so and points at `--demo`.
 | `d` | Delete the selected rule |
 | `e` | Enable or disable the firewall (ufw only) |
 | `r` | Reload the firewall |
-| `p` | Change a default policy (ufw) or a zone target (firewalld) |
+| `p` | Change a default policy (ufw), a zone target (firewalld) or a chain policy (iptables, nftables) |
 | `L` | Change the logging level (ufw) or the log-denied value (firewalld) |
 | `l` | Toggle logging on the selected rule (nftables) |
 | `w` | Watch the live firewall log of the logged rules (nftables) |
 | `W` | Save the tool's own table to a file loaded on boot, with a diff preview (nftables) |
+| `W` | Persist the running rules to the files restored at boot, with a diff preview (iptables) |
 | `x` | Actions this backend offers beyond these keys |
 | `[` / `]` | Previous / next group — the firewalld zones and policy objects |
 | `R` | Re-read the firewall |
@@ -395,6 +400,94 @@ collects the answers and previews whatever comes back. That is the same reason
 `e` is absent on firewalld — starting and stopping a system service is
 `systemctl`'s job, and the tool says so instead of doing it quietly.
 
+## iptables
+
+![The iptables INPUT chain of a cloud image](docs/screenshots/tui-firewall-iptables.png)
+
+Many cloud images ship no ufw and no firewalld. Their firewall is a plain
+iptables ruleset, restored at boot by **iptables-persistent** (Debian, Ubuntu:
+`/etc/iptables/rules.v4` and `rules.v6`) or **iptables-services** (Fedora, RHEL:
+`/etc/sysconfig/iptables`), and the INPUT chain ends in a catch-all:
+
+```
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+```
+
+On such a machine `tui-firewall` drives `iptables` and `ip6tables` directly. It
+reads the rules with `iptables-save -c` and `ip6tables-save -c` (both the
+`nf_tables` and the `legacy` variants), shows one view per chain and family,
+`INPUT (iptables)` beside `INPUT (ip6tables)`, and writes only to the built-in
+`INPUT`, `FORWARD` and `OUTPUT` chains of the filter table. The chains docker,
+tailscaled, kube-proxy or fail2ban create are shown and left alone, because
+those daemons rebuild them every time they start.
+
+### Where a new rule goes
+
+An appended allow after the catch-all never matches. So a new rule is inserted
+**in front of the catch-all REJECT or DROP**, and the preview says so:
+
+![Adding a rule before the catch-all](docs/screenshots/tui-firewall-iptables-add.png)
+
+```
+Insert a rule at position 5 of INPUT (iptables)
+inserted at position 5 of INPUT, right before rule 5 (-j REJECT --reject-with
+icmp-host-prohibited): that rule catches everything, so a rule appended after
+it would never match
+
+$ sudo -n iptables -I INPUT 5 -p udp -m udp --dport 51820 -j ACCEPT
+```
+
+A chain with no catch-all gets the rule at its end, where the policy decides
+what nothing matched. An explicit position in the form is honoured, unless it
+lands after the catch-all, which is refused with the reason. A rule is deleted
+by its **specification** (`iptables -D INPUT -p tcp ... -j ACCEPT`), not by its
+number, so a rule another daemon inserted in the meantime cannot shift the
+delete onto a neighbour.
+
+### Persisting is its own step
+
+A change applies to the running kernel, and the next boot restores the saved
+file. The header says which state you are in (`saved: in sync`, or
+`saved: differs: 1 line not saved (W)`), the status line repeats it after every
+change, and `W` persists, with the diff between the saved file and the running
+rules in the preview:
+
+![Persisting with a diff preview](docs/screenshots/tui-firewall-iptables-persist.png)
+
+The command is the persistence layer's own: `netfilter-persistent save` on
+Debian and Ubuntu, `service iptables save` and `service ip6tables save` on RHEL.
+The comparison covers the filter table and leaves out the chains other daemons
+rebuild, so a host where tailscaled added `ts-input` after the last save still
+reads as in sync.
+
+Staging (`s`, `S`, `k`) works here too: the batch applies through
+`iptables-restore --noflush`, all or nothing per address family, and if the
+keep window runs out the filter table is restored from a snapshot taken right
+before the apply.
+
+### Which backend is chosen, and why
+
+`auto` picks iptables when its loader is active or enabled
+(`netfilter-persistent`, or the `iptables` unit of iptables-services), when the
+nft ruleset shows iptables-nft filter tables carrying rules of the operator's
+own, or when the legacy iptables tables do. Docker's plumbing alone does not
+count: a pure-nft host running docker stays on nftables. A running ufw or
+firewalld always wins, since both of them drive iptables underneath. The
+selection line in the header, `--check` and `--report` says which of these it
+was, and names any native nft table the iptables backend does not show.
+
+The nftables backend, in turn, refuses to write into a table iptables-nft owns
+(`ip filter` with its upper-case chains and xtables matches): a native rule
+there can make `iptables-save` refuse the table, which breaks
+`netfilter-persistent save`, and is lost when the saved rules are restored at
+boot. The refusal points at `--backend iptables`.
+
+`--check` carries an `iptables` block: the variant, the writable chains and
+where a new rule would land in each, the ports INPUT accepts ahead of its
+catch-all (and any accept that sits after it and never matches), and the
+persistence layer with the drift between running and saved rules.
+
 ## nftables
 
 ![The nftables rule list](docs/screenshots/tui-firewall-nftables.png)
@@ -592,6 +685,20 @@ are capped, so a firewall under a scan cannot grow it without bound.
   from the same guided form.
 - Zone target, log-denied value, reload, and the actions menu above.
 
+**iptables**
+
+- Read `iptables-save -c` and `ip6tables-save -c` (nf_tables or legacy) and show
+  INPUT, FORWARD and OUTPUT of both families, then every other chain that holds a
+  rule, read-only.
+- Insert a rule right before the chain's catch-all REJECT or DROP, with the
+  position and the reason in the preview; refuse a position after it. Delete by
+  specification.
+- Persist with `netfilter-persistent save` or `service iptables save`, previewed
+  with the diff against the saved files; report runtime-vs-saved drift in the
+  header, the status line and `--check`.
+- Stage changes and apply them through `iptables-restore --noflush`, with the
+  same keep-or-roll-back window as nftables.
+
 **nftables**
 
 - Read `nft -j list ruleset` and show every base and used regular chain, its
@@ -694,6 +801,20 @@ hidden; one below the minimum is marked as such and the tool still runs.
 | `==2.0.0` | `--permanent --list-all-zones` prints the same settings for every zone on this release (firewalld#1152), so the permanent half of the runtime/permanent comparison is not trustworthy; 2.0.1 fixed it |
 | `>=2.2` | firewalld removed the lockdown feature, so no lockdown state is shown |
 
+### iptables
+
+| | |
+| --- | --- |
+| Binary | `iptables` |
+| Version read with | `iptables --version` |
+| Minimum | 1.6 |
+| Tested | `1.8.10` |
+
+| Versions | What changes |
+| --- | --- |
+| `<1.8` | only the legacy xtables interface exists, so the rules live outside nf_tables and the nft ruleset cannot show them; the backend reads them through iptables-save and the selector asks the legacy tables directly |
+| `>=1.8` | iptables-nft writes table ip filter and ip6 filter in nf_tables, and `iptables --version` says which variant is installed; the nftables backend treats those tables as read-only and points here |
+
 ### nftables
 
 | | |
@@ -729,7 +850,7 @@ environment. Flags override everything. See
 [`examples/config.toml`](examples/config.toml).
 
 ```toml
-# Which firewall to drive: "auto", "ufw" or "firewalld".
+# Which firewall to drive: "auto", "ufw", "firewalld", "iptables" or "nftables".
 backend = "auto"
 
 # Privilege escalation prefix; "" runs the command directly.
@@ -744,8 +865,10 @@ service is running. If neither is running it takes the one systemd would start
 at boot (`systemctl is-enabled`), and if neither is enabled either, the first
 one installed — ufw before firewalld. Having both on one machine is a
 misconfiguration rather than a supported setup, so the tie-break exists to be
-predictable; name the one you mean when both are present. With nothing
-installed it exits with a message naming what to install.
+predictable; name the one you mean when both are present. Then comes iptables,
+when a loader restores its saved rules or its tables carry rules of their own
+(see [iptables](#iptables)), and last nftables, for a machine nothing else
+manages. With nothing installed it exits with a message naming what to install.
 
 ## Theme
 
 
@@ -107,6 +107,9 @@ type app struct {
 	// pendingSave marks the change at the confirm dialog as the save, so a yes
 	// clears the "not written yet" state of the spec.
 	pendingSave bool
+	// persistHintPending asks the next load to add the "W persists" reminder
+	// to the status line when the running rules now differ from the saved ones.
+	persistHintPending bool
 	// saveOfferPending asks the next load to offer the save, so the disabled
 	// rule is on screen before the dialog that writes it to disk opens.
 	saveOfferPending bool
@@ -242,6 +245,12 @@ func (a *app) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		}
 		a.loadFailed = false
 		a.model = msg.model
+		if a.persistHintPending {
+			a.persistHintPending = false
+			if p, ok := a.backend.(persister); ok && !p.PersistState().Drift.InSync {
+				a.status += "  ·  runtime only, W persists"
+			}
+		}
 		if _, ok := a.model.Group(a.group); !ok && len(a.model.Groups) > 0 {
 			a.group = a.model.Groups[0].Name
 		}
@@ -295,8 +304,10 @@ func (a *app) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		a.setStatusf(ui.StatusOK, "%s: %s", msg.change.Description, firstLine(summary))
 		// On a backend whose changes are runtime-only until persisted, the
 		// success line says so: the next boot restores the saved file.
+		// The reload decides: a change that put the rules back where the saved
+		// file has them (a rollback, a re-add) needs no reminder.
 		if _, ok := a.backend.(persister); ok && !wasSave {
-			a.status += "  ·  runtime only, W persists"
+			a.persistHintPending = true
 		}
 		a.loading = true
 		if wasSave {
 
@@ -232,6 +232,9 @@ type iptablesFacts struct {
 	// and no catch-all, every port not refused above is open, which the
 	// openInput list alone would not say.
 	InputEnd map[string]string `json:"inputEnd"`
+	// InputRules counts the rules of INPUT per family, for a smoke test to
+	// compare with `iptables -S INPUT`.
+	InputRules map[string]int `json:"inputRules"`
 	// Persistence is the layer that restores the rules at boot and the drift
 	// between it and the running rules.
 	Persistence iptablesPersistence `json:"persistence"`
@@ -273,18 +276,19 @@ func collectIptablesFacts(backend firewall.Backend, model firewall.Model) *iptab
 	}
 	state := source.State()
 	facts := &iptablesFacts{
-		Version:   state.V4.Version,
-		Variant:   state.V4.Variant,
-		HasV6:     state.HasV6,
-		TablesV4:  len(state.V4.Tables),
-		TablesV6:  len(state.V6.Tables),
-		RulesV4:   countDumpRules(state.V4),
-		RulesV6:   countDumpRules(state.V6),
-		Warnings:  append(append([]string(nil), state.V4.Warnings...), state.V6.Warnings...),
-		Writable:  []string{},
-		Placement: map[string]string{},
-		OpenInput: map[string][]string{},
-		InputEnd:  map[string]string{},
+		Version:    state.V4.Version,
+		Variant:    state.V4.Variant,
+		HasV6:      state.HasV6,
+		TablesV4:   len(state.V4.Tables),
+		TablesV6:   len(state.V6.Tables),
+		RulesV4:    countDumpRules(state.V4),
+		RulesV6:    countDumpRules(state.V6),
+		Warnings:   append(append([]string(nil), state.V4.Warnings...), state.V6.Warnings...),
+		Writable:   []string{},
+		Placement:  map[string]string{},
+		OpenInput:  map[string][]string{},
+		InputEnd:   map[string]string{},
+		InputRules: map[string]int{},
 	}
 	for _, family := range iptables.Families() {
 		if family == iptables.V6 && !state.HasV6 {
@@ -294,6 +298,7 @@ func collectIptablesFacts(backend firewall.Backend, model firewall.Model) *iptab
 		if !ok {
 			continue
 		}
+		facts.InputRules[string(family)] = len(chain.Rules)
 		if at, rule := chain.CatchAll(); at > 0 {
 			facts.InputEnd[string(family)] = fmt.Sprintf("rule %d: %s", at,
 				rule.Match.TargetDetail())
 
@@ -198,7 +198,7 @@ func (a *app) openApplyConfirm(change firewall.Change) {
 	body := fmt.Sprintf(
 		"These %d change(s) apply %s. "+
 			"After they apply you have %s to press k and keep them; if you lose "+
-			"access and do not, the snapshot below is restored automatically.",
+			"access and do not, the snapshot taken just before is restored automatically.",
 		a.staging.Len(), a.staging.Atomicity(), a.staging.Timeout().Round(time.Second))
 	a.pendingApply = true
 	a.mode = modeConfirm
 
@@ -408,6 +408,15 @@ func describeRule(r firewall.Rule) string {
 		parts = append(parts, string(r.Direction))
 	}
 	parts = append(parts, r.To, "from", r.From)
+	// A backend whose destination column does not already carry the port
+	// (nftables, iptables) gets it spelled out, so the dialog names the rule.
+	if r.Ports != "" && !strings.Contains(r.To, r.Ports) {
+		port := "port " + r.Ports
+		if r.Proto != "" {
+			port += "/" + r.Proto
+		}
+		parts = append(parts, port)
+	}
 	if r.Comment != "" {
 		parts = append(parts, "#", r.Comment)
 	}
 
@@ -1,3 +1,4 @@
 {"backend": "ufw", "date": "2026-08-30", "distro": "omarchy-server-4.0.1", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "0.36.2"}
 {"backend": "ufw", "date": "2026-08-30", "distro": "ubuntu-24.04", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "0.36.2"}
 {"backend": "firewalld", "date": "2026-08-30", "distro": "fedora-44", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "2.4.4"}
+{"backend": "iptables", "date": "2026-09-25", "distro": "ubuntu-24.04", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "1.8.10"}