I am quite unable to find out what the consequences of a missing RETURN-rule at the end of user-defined iptables chains are. Obviously "iptables [missing] return [jump]" are really, really bad keywords to look for.

The manpage and any blog or howto I could dig up just tell me what -j RETURN does (which is quite obvious) but not what happens if it is missing. Also, I cannot seem to set up sane experimental rules to try it out...

iptables -N userchainA
iptables -A INPUT -j userchainA
iptables -N userchainB
iptables -A INPUT -j userchainB
iptables -A INPUT -j ACCEPT

iptables -A userchainA ... # anything here, that DOES NOT MATCH
#### no explicit return from userchainA!

iptables -A userchainB ... # anything here, that DOES NOT MATCH
iptables -A userchainB -j RETURN 

Given these rules, anything works just fine. Packets travel through all the chains and finally hit the ACCEPT from INPUT as if the (missing) -j RETURN from userchainA would be done implicitly. Is this the case?

Why is this working? I would have expected some kind of error or at least a log message about execution falling of a chain.

1 Answer 1


When iptables reaches the end of a user-defined chain, flow returns to the next rule in the calling chain. The RETURN is therefore implicit; it does not need to be explicitly given.

  • Argh! I knew this would be a short one. Thanks for pointing me to this. Jan 18, 2013 at 2:05
  • Every rule has a default target -- something has to happen if a packet doesn't match any rule in the chain. Jan 18, 2013 at 5:59
  • 2
    Sorry, David, but only built-in chains can have policies set; user-defined tables, such as the one in this question, can not. Check the man page on iptables -P.
    – MadHatter
    Jan 18, 2013 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.