1

For the following iptables rule:

iptables -A INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT

I am not sure what the point of "-m" is given that "-p" is already present. Does it serve any purpose in this case? Can the above be simplified to one of the below while retaining all the functions?

iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT

OR

iptables -A INPUT -m icmp --icmp-type 255 -j ACCEPT

Thanks for any tips.

1 Answer 1

4

-p specifies the protocol while -m specifies the matching module which is used. The matching module might have a different type or you could specify multiple modules there. This is why you need separate flags. See the iptables manpage section MATCH EXTENSIONS for the various uses of -m.

However, in your case -p x implies -m x, so the second rule works equally well as the first one. The third rule is invalid. Though -m can stand alone in some cases, you have to use it along -p here as you cannot use a (protocol) matching module without explicitly specifying the protocol.

9
  • Extensions like state, conntrack, etc.
    – Hello71
    Feb 2, 2013 at 2:37
  • Correct, -m state does not need a protocol. -m multiport <portlist> does, for another famous example. See the manpage for more. Feb 2, 2013 at 2:42
  • 1
    To clarify things a bit, think of -m and -j as plugins that load additional functionality and allow additional command parameters to be understood. For example, --comment is meaningless to the iptables command until -m comment is specified. You can find a description of loadable -m (matching) and -j (target) modules and the additional parameters they enable in the iptables manual page.
    – Andrew B
    Feb 2, 2013 at 6:03
  • Actually, IIRC, -j doesn't load a module; it jumps to an already known target.
    – Hello71
    Feb 2, 2013 at 13:10
  • thank you for the answer and for the comments. i have been reading up on the iptables command but it seems that the following syntax is valid: iptables -A INPUT -m tcp ...... but your answer suggests this is not correct? can you please clarify. Thanks again.
    – tonytz
    Feb 3, 2013 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .