I am quite unable to find out what the consequences of a missing RETURN-rule at the end of user-defined iptables chains are. Obviously "iptables [missing] return [jump]" are really, really bad keywords to look for.

The manpage and any blog or howto I could dig up just tell me what -j RETURN does (which is quite obvious) but not what happens if it is missing. Also, I cannot seem to set up sane experimental rules to try it out...

iptables -N userchainA
iptables -A INPUT -j userchainA
iptables -N userchainB
iptables -A INPUT -j userchainB
iptables -A INPUT -j ACCEPT

iptables -A userchainA ... # anything here, that DOES NOT MATCH
#### no explicit return from userchainA!

iptables -A userchainB ... # anything here, that DOES NOT MATCH
iptables -A userchainB -j RETURN 

Given these rules, anything works just fine. Packets travel through all the chains and finally hit the ACCEPT from INPUT as if the (missing) -j RETURN from userchainA would be done implicitly. Is this the case?

Why is this working? I would have expected some kind of error or at least a log message about execution falling of a chain.

1 Answer 1


When iptables reaches the end of a user-defined chain, flow returns to the next rule in the calling chain. The RETURN is therefore implicit; it does not need to be explicitly given.

  • Argh! I knew this would be a short one. Thanks for pointing me to this. Jan 18, 2013 at 2:05
  • Every rule has a default target -- something has to happen if a packet doesn't match any rule in the chain. Jan 18, 2013 at 5:59
  • 2
    Sorry, David, but only built-in chains can have policies set; user-defined tables, such as the one in this question, can not. Check the man page on iptables -P.
    – MadHatter
    Jan 18, 2013 at 6:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .