Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have iptables rule which i hope to allow ssh from 2 ips .

Why is counter increasing for second rule and not for first rule.

Even if i try from both ip i am not able to ssh to it.

Chain INPUT (policy ACCEPT 87 packets, 6188 bytes)
pkts bytes target     prot opt in     out     source          destination
0     0 REJECT       tcp  --  *      *      !115.x.x.71            tcp dpt:22 reject-with icmp-port-unreachable

14  1400 REJECT     tcp  --  *      *      !115.x.x.176            tcp dpt:22 reject-with icmp-port-unreachable

isn't it like when i ssh from 115.x.x.71 it matches with first rule and i should get access and it will not be matched against second and even if i ssh from 115.x.x.176 it is against first rule and it will be rejected,but i am not able to ssh even from first ip.

share|improve this question
up vote 5 down vote accepted

This will never work!


  1. If you connect from .71 the second rule will reject your connction
  2. If you connect from anywhere the first rule will reject your connection

The reson for this is because if a rule does not match in iptables it will go on to the next rule.

You have to allow connections from .71 and .176 and after that reject all other connections.

Why the counters are not increased on the first rule: I don't know.

EDIT to clarify things a bit:

iptables checks the rules one after the other. If a rule matches the evalutaion stops with the result so far. Therefore for your rules iptables will do the following:

  1. If you connect from .71
    • The first rule does not match (because the src !x.x.x.71 does not match)
    • The second rule rejects the request (because the src !x.x.x.176 matches) and the result should be a REJECT
  2. If you connect from somewhere else (eg. x.x.x.176)
    • The first rule matches (because the src !x.x.x.71 matches) and therefore the connection is rejected.

So to meet your requirements you have to first accept connections from .71 and .176 in the first rules and then reject all others.

Please read some tutorial on iptables to learn how it works also look at the answer from dmourati for a running example.

share|improve this answer
when i connect from .71 shouldn't it allow that packets from .71 as it matches with first rule and hence this packet will not be considered against second rule as it already found a matching rule. – Kevin Parker Jun 7 '13 at 13:20
The counters in the first rule are not increasing most likely because OP is attempting to connect from 115.x.x.71. The rest of your answer is spot on. +1. – Steven Monday Jun 7 '13 at 13:35
@KevinParker No because iptables work the way I described: If a rule does not match the next rule is tested. – Uwe Plonus Jun 7 '13 at 13:35
So if there is no second rule i am able to connect from .71 and no other ips can connect so that means first rule allows only .71 but when i add second rule why first is not matching? – Kevin Parker Jun 7 '13 at 14:36
@KevinParker I extended my answer to clarify things a bit. – Uwe Plonus Jun 10 '13 at 6:07
iptables -A INPUT -p tcp --dport 22 -s IP-ADDR-1 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s IP-ADDR-2 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j REJECT
share|improve this answer
I thought Uwe's explanation above was excellent, but I have to admit there's a certain utility in giving a simple example of how to do it right! Kevin, these rules would need to replace the existing rules controlling access to port 22; if you just put them at the end (where they will go by default, that's what -A does) they'll fail for the reasons Uwe has outlined. dmourati, I hope you'll forgive my making rule 3 specific to ssh traffic; that seemed closest to what the OP's original rules did. – MadHatter Jun 10 '13 at 6:30
Sounds reasonable. – dmourati Jun 10 '13 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.