Skip to content
Browse

/commands/iptables/iptables-list-rules-line-numbers

iptables -L -n -v --line-numbers: list rules with counters and numbers

The commands on this page have not been executed by our verification runner yet.updated
tool
iptables / nftables
versions
iptables 1.8
os
linux

sudo iptables -L -n -v --line-numbers lists every rule of the filter table with packet and byte counters (-v), numeric addresses and ports (-n, no slow DNS lookups) and a number per rule (--line-numbers) that you can pass to -D or -I. Add -t nat (or mangle, raw) to see other tables, and a chain name to list only that chain. sudo iptables -S prints the same rules as the commands that would recreate them.

Commands

bash
sudo iptables -L -n -v --line-numbers            # filter table, all chains
sudo iptables -L INPUT -n -v --line-numbers      # one chain
sudo iptables -t nat -L -n -v --line-numbers     # NAT rules (DNAT, MASQUERADE, Docker port mappings)
sudo iptables -S                                 # rules as iptables commands
sudo iptables -S INPUT
sudo ip6tables -L -n -v --line-numbers           # IPv6 rules are separate

Reading the output

An example (your rules and counters differ):

text
Chain INPUT (policy DROP 120 packets, 7200 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     5120  410K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
2     8.2M  9.1G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
3      310 18600 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
  • policy is what happens to packets that match no rule; the counters next to it count those packets.
  • Rules are evaluated top to bottom; the first terminating match (ACCEPT, DROP, REJECT) wins. A rule with zero pkts after real traffic is either unused or shadowed by an earlier rule.
  • -x prints exact counters instead of K, M, G units.

Use the numbers

bash
sudo iptables -D INPUT 3                          # delete rule 3 of INPUT
sudo iptables -I INPUT 2 -p tcp --dport 443 -j ACCEPT   # insert before the current rule 2
sudo iptables -R INPUT 3 -p tcp --dport 2222 -j ACCEPT  # replace rule 3
sudo iptables -Z INPUT                            # reset the counters of INPUT

Numbers shift after every insert or delete; list again before using a number a second time.

nftables backend

On distributions where iptables is iptables-nft, these rules are stored in nftables tables named ip filter, ip nat and so on; sudo nft list ruleset shows them together with native nftables rules.

Sources

Related pages

commands · iptablesiptables -D: delete a rule by number or by specificationDelete an iptables rule with -D by its line number or by the exact specification from iptables -S. Shifting numbers, flushing chains, errors and persistence.commands · iptablesSave iptables rules permanently: iptables-save, iptables-restore and persistence after rebootiptables rules vanish at reboot. Save with iptables-save, load with iptables-restore, and persist them with netfilter-persistent on Debian or iptables-services.errors · iptablesiptables: No chain/target/match by that name.A chain, target or match module in the iptables command does not exist. Create the chain with -N, use -t nat for NAT targets, and load missing kernel modules.errors · iptablesiptables: Permission denied (you must be root)iptables needs root or CAP_NET_ADMIN to read or change rules. Run it with sudo; in Docker or Kubernetes add the NET_ADMIN capability, not privileged mode.compare · iptablesiptables vs nftables: differences and migrationnftables replaces iptables, ip6tables, arptables and ebtables with one tool, nft, one syntax and atomic updates; iptables-nft keeps iptables commands working.flags · iptablesiptables -I vs -A: insert a rule at the top instead of appending itiptables -I inserts a rule at the top (or at position N) while -A appends it at the end. First match wins, so a DROP appended after an ACCEPT never runs.