User guide

Command Options for IPTables
83
Regardless of their destination, when packets match a particular rule in one of the tables, a target
or action is applied to them. If the rule specifies an ACCEPT target for a matching packet, the packet
skips the rest of the rule checks and is allowed to continue to its destination. If a rule specifies a DROP
target, that packet is refused access to the system and nothing is sent back to the host that sent the
packet. If a rule specifies a QUEUE target, the packet is passed to user-space. If a rule specifies the
optional REJECT target, the packet is dropped, but an error packet is sent to the packet's originator.
Every chain has a default policy to ACCEPT, DROP, REJECT, or QUEUE. If none of the rules in the chain
apply to the packet, then the packet is dealt with in accordance with the default policy.
The iptables command configures these tables, as well as sets up new tables if necessary.
2.6.2. Command Options for IPTables
Rules for filtering packets are created using the iptables command. The following aspects of the
packet are most often used as criteria:
• Packet Type — Specifies the type of packets the command filters.
• Packet Source/Destination — Specifies which packets the command filters based on the source or
destination of the packet.
• Target — Specifies what action is taken on packets matching the above criteria.
Refer to Section 2.6.2.4, “IPTables Match Options” and Section 2.6.2.5, “Target Options” for more
information about specific options that address these aspects of a packet.
The options used with specific iptables rules must be grouped logically, based on the purpose and
conditions of the overall rule, for the rule to be valid. The remainder of this section explains commonly-
used options for the iptables command.
2.6.2.1. Structure of IPTables Command Options
Many iptables commands have the following structure:
iptables [-t <table-name>] <command> <chain-name> \ <parameter-1> <option-1> \ <parameter-
n> <option-n>
<table-name> — Specifies which table the rule applies to. If omitted, the filter table is used.
<command> — Specifies the action to perform, such as appending or deleting a rule.
<chain-name> — Specifies the chain to edit, create, or delete.
<parameter>-<option> pairs — Parameters and associated options that specify how to process a
packet that matches the rule.
The length and complexity of an iptables command can change significantly, based on its purpose.
For example, a command to remove a rule from a chain can be very short:
iptables -D <chain-name> <line-number>
In contrast, a command that adds a rule which filters packets from a particular subnet using a variety
of specific parameters and options can be rather long. When constructing iptables commands, it is
important to remember that some parameters and options require further parameters and options to
construct a valid rule. This can produce a cascading effect, with the further parameters requiring yet
more parameters. Until every parameter and option that requires another set of options is satisfied, the
rule is not valid.