Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

iptables doesn't seem to recognize --dport with -p all.

iptables -A INPUT -p all --dport www -j ACCEPT


iptables v1.4.4: unknown option `--dport'
Try `iptables -h' or 'iptables --help' for more information.

--destination-port doesn't work either: iptables v1.4.4: unknown option `--destination-port'

Adding two separate rules for -p tcp and -p udp works fine, so why doesn't it work for -p all?

In case it matters, this is on an Ubuntu 10.04 LTS Server with iptables package version 1.4.4-2ubuntu2

share|improve this question
up vote 11 down vote accepted

--dport is not a flag for general iptables rules. It's a flag for one of it's extended packet matching modules. These are loaded when you use -p protocol or -m. Unless you specify -m <protocol> or -p <protocol> with a specific protocol you can't use --dport

You'll see this within the iptables(8) manual page:

       These extensions can be used if `--protocol tcp' is specified. It provides the
       following options:
       [!] --destination-port,--dport port[:port]
              Destination port or port range specification.  The flag --dport is a
              convenient alias for this option.

Not all protocols have a --dport flag because not all protocols support the notion of ports

share|improve this answer

'all' encompasses more than just TCP and UDP; it also covers protocols like ICMP which have no concept of port numbers, and thus can't take a --dport parameter.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.