I have packets from 2 subnets going into my firewall eth1: and

I set iptables rules like that:

 iptables -A INPUT -i eth1 ! -s -j DROP
 iptables -A INPUT -i eth1 ! -s -j DROP

But - the first rule doesnt allow to check the second one because is NOT and it is matching first rule. How to fix it ?

2 Answers 2


The easiest way to do that is to mark allowed packets and later drop all packets that are not marked:

iptables -t mangle -A PREROUTING -i eth1 -s -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -i eth1 -s -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -i eth1 -m mark ! --mark 1 -j DROP

You should consider that there might be other packets that you need/want to get through.


A chain would be a useful method here. A chain acts somewhat like a subroutine or function. The RETURN just means the control for that packet will be return to the previous chain and rules will continue to be evaluated.

# create a new chain
iptables -t filter -N in_validnet

# all incoming packets on eth1 are evaluated by the chain
iptables -t filter -A INPUT -i eth1 -j in_validnet

# packets from these networks are returned for further evaluation
iptables -A in_validnet -s -j RETURN
iptables -A in_validnet -s -j RETURN

# everything else gets dropped
iptables -A in_validnet -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.