Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

iptables doesn't seem to recognize --dport with -p all.

iptables -A INPUT -p all --dport www -j ACCEPT

yields:

iptables v1.4.4: unknown option `--dport'
Try `iptables -h' or 'iptables --help' for more information.

--destination-port doesn't work either: iptables v1.4.4: unknown option `--destination-port'

Adding two separate rules for -p tcp and -p udp works fine, so why doesn't it work for -p all?

In case it matters, this is on an Ubuntu 10.04 LTS Server with iptables package version 1.4.4-2ubuntu2

share|improve this question

2 Answers 2

up vote 10 down vote accepted

--dport is not a flag for general iptables rules. It's a flag for one of it's extended packet matching modules. These are loaded when you use -p protocol or -m. Unless you specify -m <protocol> or -p <protocol> with a specific protocol you can't use --dport

You'll see this within the iptables(8) manual page:

   tcp
       These extensions can be used if `--protocol tcp' is specified. It provides the
       following options:
       ...
       [!] --destination-port,--dport port[:port]
              Destination port or port range specification.  The flag --dport is a
              convenient alias for this option.
       ...

Not all protocols have a --dport flag because not all protocols support the notion of ports

share|improve this answer

'all' encompasses more than just TCP and UDP; it also covers protocols like ICMP which have no concept of port numbers, and thus can't take a --dport parameter.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.