Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have noticed the following iptables rule order executed by a program:

iptables -A INPUT -p all -j ACCEPT

iptables -A INPUT -p all -s ip_address -j REJECT

I thought that based on the ordering principle of iptables, this would lead to the second line being ignored (ie. the ip_address will not be rejected because all connections are already accepted by the first line). Does it mean that this program is misconfigured?

Thanks in advance

share|improve this question
1  
yup, you're right! test it to verify. –  Matt Feb 18 '13 at 23:09
    
Ya i tested it but i wasn't sure if I missed something. It confuses me when a reputable program does something unexpected. thanks for your confirmation! –  tonytz Feb 18 '13 at 23:16

1 Answer 1

up vote 4 down vote accepted

Yes, the rules will be executed in that order. Assuming there are no other interrelated rules not displayed in your question, this won't deny the host with -s ip_address ip address. If you want that ip address to be rejected, replace -A (Append) with -I (Insert).

/sbin/iptables -I -p all -s ip_address -j REJECT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.