1

For the following iptables rule:

iptables -A INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT

I am not sure what the point of "-m" is given that "-p" is already present. Does it serve any purpose in this case? Can the above be simplified to one of the below while retaining all the functions?

iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT

OR

iptables -A INPUT -m icmp --icmp-type 255 -j ACCEPT

Thanks for any tips.

1 Answer 1

4

-p specifies the protocol while -m specifies the matching module which is used. The matching module might have a different type or you could specify multiple modules there. This is why you need separate flags. See the iptables manpage section MATCH EXTENSIONS for the various uses of -m.

However, in your case -p x implies -m x, so the second rule works equally well as the first one. The third rule is invalid. Though -m can stand alone in some cases, you have to use it along -p here as you cannot use a (protocol) matching module without explicitly specifying the protocol.

9
  • Extensions like state, conntrack, etc.
    – Hello71
    Feb 2, 2013 at 2:37
  • Correct, -m state does not need a protocol. -m multiport <portlist> does, for another famous example. See the manpage for more. Feb 2, 2013 at 2:42
  • 1
    To clarify things a bit, think of -m and -j as plugins that load additional functionality and allow additional command parameters to be understood. For example, --comment is meaningless to the iptables command until -m comment is specified. You can find a description of loadable -m (matching) and -j (target) modules and the additional parameters they enable in the iptables manual page.
    – Andrew B
    Feb 2, 2013 at 6:03
  • Actually, IIRC, -j doesn't load a module; it jumps to an already known target.
    – Hello71
    Feb 2, 2013 at 13:10
  • thank you for the answer and for the comments. i have been reading up on the iptables command but it seems that the following syntax is valid: iptables -A INPUT -m tcp ...... but your answer suggests this is not correct? can you please clarify. Thanks again.
    – tonytz
    Feb 3, 2013 at 1:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.