Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could someone shed some light on what the current iptables entry on my RedHat machine means?

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

It is the last line in my /etc/sysconfig/iptables file

Any rule I add after that does not take affect. I have to add all rules above that line.

Is there a top to bottom precedence in the iptables file? (rule on top take precedence over rules bellow)

share|improve this question
up vote 4 down vote accepted

Iptables rules will be applied in order. This rule will match all packets (there is no port/address/etc listed), jump to the REJECT table (which will reject the packet), and send an icmp host prohibited packet back to the source.

You should also look at the INPUT table, as this rule is added to the RH-Firewall-1-INPUT table (the -A option).

share|improve this answer

In general, firewall rules are applied top to bottom. It's like that (as far as I know) in iptables as well as on most Cisco PIX/Firewall products.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.