Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have noticed the following iptables rule order executed by a program:

iptables -A INPUT -p all -j ACCEPT

iptables -A INPUT -p all -s ip_address -j REJECT

I thought that based on the ordering principle of iptables, this would lead to the second line being ignored (ie. the ip_address will not be rejected because all connections are already accepted by the first line). Does it mean that this program is misconfigured?

Thanks in advance

share|improve this question
yup, you're right! test it to verify. – Matt Feb 18 '13 at 23:09
Ya i tested it but i wasn't sure if I missed something. It confuses me when a reputable program does something unexpected. thanks for your confirmation! – tonytz Feb 18 '13 at 23:16
up vote 5 down vote accepted

Yes, the rules will be executed in that order. Assuming there are no other interrelated rules not displayed in your question, this won't deny the host with -s ip_address ip address. If you want that ip address to be rejected, replace -A (Append) with -I (Insert).

/sbin/iptables -I -p all -s ip_address -j REJECT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.