10

In many examples, I see the following 2 consecutive commands:

iptables -F
iptables -X

From the man page, I cannot figure out the difference between flushing and deleting. Is there a difference between these two?

0

2 Answers 2

11

For all chains you can -F :

+---------------+       +---------------+
|               |       |               |
| Chain MyChain |       | Chain MyChain |
|     Rule 1    |  -F   |      is       |
|     Rule 2    |       |     empty     |
|     Rule 3    |  ==>  |               |
|               |       |               |
+---------------+       +---------------+

For user defined chains only (chain created with iptables -N MyChain) you can -X if it is empty :

+---------------+
|               |
| Chain MyChain |         Chain MyChain
|      is       |  -X      does not exist
|     empty     |
|               |  ==>
|               |
+---------------+

Both

iptables -F
iptables -X

are used because one can delete a user defined chain only when it is empty. Built-in chains cannot be deleted, but can be flushed.

5

iptables -F flushes the rules of a chain.

http://explainshell.com/explain?cmd=iptables+-F

-F, --flush [chain] Flush the selected chain (all the chains in the table if none is given). This is equivalent to deleting all the rules one by one.

iptables -X deletes a chain.

http://explainshell.com/explain?cmd=iptables+-X

-X, --delete-chain [chain] Delete the optional user-defined chain specified. There must be no references to the chain. If there are, you must delete or replace the referring rules before the chain can be deleted. The chain must be empty, i.e. not contain any rules. If no argument is given, it will attempt to delete every non-builtin chain in the table.

4
  • 1
    Yes, I read the man page. What I want to know is if there is a difference. Cause the end result seems to be exactly the same.
    – Stéphane
    Jan 3, 2015 at 19:25
  • The difference is the same as deleting all files in a directory, or the directory itself.
    – ptman
    Jan 3, 2015 at 19:26
  • A rule is not the same as a chain. Edit: ptman explained it better :)
    – Cha0s
    Jan 3, 2015 at 19:26
  • Yes. iptables -X deletes user defined chains
    – Cha0s
    Jan 3, 2015 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .