Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using netfilter_queue to pick up certain packets from the kernel and do some processing on them. To, the netfilter queue, I need all packets from a particular source except UDP packets with src port 2152 & dst port 2152.

I try to add the iptable rule as

iptables -A OUTPUT ! s ! -p udp ! --sport 2905 ! --dport 2905 -j NFQUEUE --queue-num 0

iptables throw up an error of Invalid Argument. Querying dmesg, I see the following error print

ip_tables: udp match: only valid for protocol 17

I have tried the following variation with the same error thrown.

iptables -A OUTPUT ! s ! -p udp --sport 2905 --dport 2905 -j NFQUEUE --queue-num 0

Can you please advise on the correct usage of the iptables command for my case.

share|improve this question
up vote 5 down vote accepted

It might be a lot easier to right your rules if you create a chain, send everything to the chain, and do a RETURN on anything you don't want the chain to handle. With a chain you can add other exceptions later without having to come up with a really convoluted rule.

iptables -t filter -N out_queue
iptables -t filter -A OUTPUT -j out_queue
iptables -t filter -A out_queue -p udp --sport 2905 -j RETURN
iptables -t filter -A out_queue -p udp --dport 2905 -j RETURN
iptables -t filter -A out_queue -j NFQUEUE --queue-num 0
share|improve this answer
+1 Nice infos. At the end is exactly what Shorewall does when it creates all the iptables rules. – Pier Jun 16 '10 at 17:08
Looks like this will work. Let me give it a shot and get back to you. Thanks a lot for this. – Aditya Sehgal Jun 17 '10 at 4:06
it works. Thanks ! – Aditya Sehgal Jun 17 '10 at 5:56

Shouldn't the ! be after the options?

iptables -A OUTPUT -s ! -p udp --sport ! 2905 --dport ! 2905 -j NFQUEUE --queue-num 0
share|improve this answer
--option ! this is deprecated in favour of ! --option this – Aditya Sehgal Jun 16 '10 at 17:00
Ah...since which version? – Pier Jun 16 '10 at 17:11
from man iptables: -s, --source [!] address[/mask] -d, --destination [!] address[/mask] – David Jun 17 '10 at 17:23

try with:

iptables -A OUTPUT -s -p udp --sport!2905 --dport!2905 -j NFQUEUE --queue-num 0
share|improve this answer
if it works, wouldn't it just give me packets from source of proto UDP which do not have src port 2905 & dst port 2905? I need packets from ANY source barring udp packets from with src port(2905) & dst port(2905) – Aditya Sehgal Jun 16 '10 at 16:58
Ah sorry...misunderstood. The shoould be: iptables -A OUTPUT -s! -p!udp --sport!2905 --dport!2905 -j NFQUEUE --queue-num 0 – Pier Jun 16 '10 at 17:11
This just does not work. What you suggest is what I tried initially and it gave me the cryptic "only valid for protocol 17" error in dmesg – Aditya Sehgal Jun 17 '10 at 4:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.