Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to allow access to port 11211 from specific IP to existing rules (In a script that runs after the server loads)

The line I want to add:

iptables -A INPUT -p tcp -s xx.xx.xx.xx --dport 11211 -j ACCEPT

But the iptables already contains a drop line for this port so my line will append after and will never work. The drop line:

DROP       tcp  --  anywhere             anywhere            tcp dpt:11211

How can I do it?

share|improve this question
up vote 5 down vote accepted

You're looking for "INSERT" instead of "APPEND". AFAIR you can use

iptables -I INPUT <slot> -p tcp -s xx.xx.xx.xx --dport 11211 -j ACCEPT

To insert the rule into the desired slot in the chain. To find the right slot number use iptables -nL Then start counting the rules starting with 1.

I think you can also omit the slot to have iptables inserting the new rule at the first slot (on top).

share|improve this answer

Use iptables -I INPUT -p tcp -s xx.xx.xx.xx --dport 11211 -j ACCEPT this will insert the rule at the beginning of the INPUT chain and will be processed before the existing DROP rule. Iptables works from top to bottom and the 1st rule to match wins. Don't forget to save the iptables configuration once your sure it's working correctly.

share|improve this answer

-A -- means appent. use -R to replace and -I to insert in chain.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.