Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following rule in our iptables config file /etc/sysconfig/iptables


And when I do iptables --list I get the following

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --          anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

However, if I do a tcpdump I can still see all these traffic from this ip, why?

tcpdump -ttttn tcp port 1234 | grep
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
2010-10-21 23:49:33.828011 IP > myip: Flags [S], seq 3522466008, win 65535, options [mss 1460,sackOK,eol], length 0
2010-10-21 23:49:33.832182 IP > myip: Flags [S], seq 1088176500, win 65535, options [mss 1460,sackOK,eol], length 0
share|improve this question

tcpdump sees inbound traffic before it hits iptables. In your example above this explains why you see inbound SYNs but not SYN/ACKs from your machine.

share|improve this answer
Whats a good way to know if the actual traffic is dropped then? – erotsppa Oct 22 '10 at 0:39
You can configure a -j LOG target that sends information about the matching (dropped) packets to the system log. Also, when you list the iptables rules with iptables -L -v -n, if you see non-zero counts next to your DROP rule, then you know that packets were matched (and hence DROPed) by that rule. – Steven Monday Oct 22 '10 at 0:47

You need to save your rules. Maybe you did, but didn't mention it? If not try this: % sudo /sbin/service iptables save

This exports the rules currently used and starts the firewall. Regardless of what you have in /etc/sysconfig/iptables this will tell you what the firewall is actually using.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.