Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a rule matched to packet and it has -j DROP, I know that the packet will stop to traverse throughout the rest of the rules. However I don't understand what will happen if the packet will match a rule with -j ACCEPT? Would it again stop to traverse throughout the rules or it will try to match other rules? In other words what will happen if a pcket has many rules to match.

share|improve this question
up vote 6 down vote accepted

First match wins, and processing stops if the target is a "terminating" target; those include DROP, ACCEPT, DNAT, and so on. They are targets that make a determination about the final disposition of the packet; there is no sense in saying -j REJECT if it can be overridden three lines later with -j OH-SORRY-I-DIDNT-MEAN-IT.

First match wins, and processing does not stop if the target is "non-terminating"; those include LOG, ULOG, and sending the packet to a user-defined chain. In that latter case, processing continues through the rules in that chain, and if none matches with a terminating target, the packet "falls out the bottom of the chain" and returns to the rule in the calling chain after the one that sent it to the user-defined chain.

Is that clear? First-match-wins always applies, which is why the order of rules is important.

share|improve this answer
That is perfectly clear, thanks! – Michael Mar 12 '11 at 7:58

In general, there are 2 kinds of iptables targets:

  • Non-terminating targets (e.g., LOG, ULOG, TOS, MARK, CONNMARK, NOTRACK, CONNTRACK)
  • Terminating targets (e.g. ACCEPT, DROP, REJECT)

Non-terminating means, after a certain action has been applied, the packet continues to the next rule in the same chain/table

Terminating means, after a certain action has been applied, processing ends on that table. If the packet still exists, the packet will then continue to the next table according to the netfilter flow sequence (see below). Of course, in the cases of REJECT and DROP, the packet no longer exist, so naturally there will be no more processing.

The wikipedia article on iptables provides a diagram on the sequence of tables/chains a packet will encounter.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.