iptables / nftables Flags & Options
Linux packet filtering.All iptables / nftables pages
- iptables -I vs -A: insert a rule at the top instead of appending itiptables -I inserts a rule at the top (or at position N) while -A appends it at the end. First match wins, so a DROP appended after an ACCEPT never runs.
- iptables -j LOG --log-prefix: log dropped packets before dropping themiptables -j LOG --log-prefix writes matching packets to the kernel log. LOG does not drop, so pair it with a DROP rule; rate limits and LOG options explained.
- iptables -m conntrack --ctstate ESTABLISHED,RELATED: allow reply trafficiptables -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT makes a firewall stateful by allowing replies. All conntrack states and a minimal INPUT chain.
- iptables -w (--wait): wait for the xtables lock instead of failingiptables -w waits for the xtables lock instead of failing with Another app is currently holding the xtables lock. Use a timeout in scripts on Docker hosts.