Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Don’t understand [0:0] iptable syntax

E.g. The command iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080, lead to the configs

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [1:132]
:OUTPUT ACCEPT [1:132]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
COMMIT

Can anyone explain the line from

:PREROUTING ACCEPT [0:0]

to

:OUTPUT ACCEPT [1:132]

Especially what is the meaning of number inside iptable rules' brackets?

share|improve this question

marked as duplicate by Zoredache, Doug Luxem, mdpc, EEAA, Khaled Jan 3 '13 at 7:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

up vote 3 down vote accepted

They are counters.. overall counters in fact.

Try this:

iptables -L INPUT

iptables -nvxL INPUT

iptables -nvxL

iptables -t nat -nvxL

iptables --line-numbers -nvxL

Now add this simple no-action rule:

iptables -A OUTPUT -p tcp -m tcp --dport 80

but without jump action, this is only a counter:

iptables --line-numbers -nvxL OUTPUT

You could make simple counter for mesuring everything you want:

iptables -A OUTPUT -p icmp -d 8.8.8.8

for counting packet using PING protocol routed to 8.8.8.8 (google-public-dns-a.google.com)

iptables -A INPUT -i eth0

for counting packet incomming from interface eth0.

More complex goals could use marked packets to sumarize more complex ideas (watching for encaplulated protocols, tracking for network location of an attacker, methods, etc...).

Using many counters is not harmfull for packet traversing, but the more rule are to check, the more time this may implie.

Read carefully iptables man page!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.