Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What i am trying to do is to DROP any packets to specific UDP port, except those one from my secured subnet

iptables -t nat -A --src -p udp --destination-port 63210 -j ACCEPT

I get this error: Bad argument:

I don't understand why this does not work...

  • Why this command says IP is bad argument?
  • How to DROP any other packets, outside subnet?
  • Should i use NAT table?
  • How to achieve this?

I've found solution like this:


iptables -N xchain
iptables -A xchain --source -j ACCEPT
iptables -A xchain -j DROP
iptables -I INPUT -p udp --dport 63210 -j xchain

After applying this, i cannot access port from ANY ip...

PROBLEM I have OpenVPN server set on tun0 interface, forwarding packets to eth0 like this:

iptables -I FORWARD -i tun0 -o eth0 \
         -s -m conntrack --ctstate NEW -j ACCEPT

iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
         -j ACCEPT

iptables -t nat -I POSTROUTING -o eth0 \
          -s -j MASQUERADE

Question is, how to catch tun0 traffic and filter it, instead of eth0, where IPs getting real.

share|improve this question
There's not enough information here. What do you mean that the first command "does not work"? Please edit your question to show the error message, and tell us what traffic passes that shouldn't, or doesn't pass that should. – Andrew Schulman Feb 19 '15 at 16:51
@AndrewSchulman updated the question. – DmitrjA Feb 19 '15 at 16:57
up vote 0 down vote accepted

In first example you are using "--src" which is incorrect swich, you should either use --source or -s.

In second example, you are creating new chain named "xchain", and you are filtering packets there. But, if you don't point packets from other chains to go traverse xchain, those filters will never get matched.

Also, you've send packets from INPUT chain to xchain:

# iptables -I INPUT -j xchain

This rule will only send packets whose destination is the host running the iptables to xchain. If your host is a router for network, you should also send packets from FILTER chain:

# iptables -I FILTER -j xchain

Note: I've changed your -A to -I, which puts rule at the top of the rule list, which means it will most certainly get traversed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.