8

In many examples, I see the following 2 consecutive commands:

iptables -F
iptables -X

From the man page, I cannot figure out the difference between flushing and deleting. Is there a difference between these two?

10

For all chains you can -F :

+---------------+       +---------------+
|               |       |               |
| Chain MyChain |       | Chain MyChain |
|     Rule 1    |  -F   |      is       |
|     Rule 2    |       |     empty     |
|     Rule 3    |  ==>  |               |
|               |       |               |
+---------------+       +---------------+

For user defined chains only (chain created with iptables -N MyChain) you can -X if it is empty :

+---------------+
|               |
| Chain MyChain |         Chain MyChain
|      is       |  -X      does not exist
|     empty     |
|               |  ==>
|               |
+---------------+

Both

iptables -F
iptables -X

are used because one can delete a user defined chain only when it is empty. Built-in chains cannot be deleted, but can be flushed.

| improve this answer | |
5

iptables -F flushes the rules of a chain.

http://explainshell.com/explain?cmd=iptables+-F

-F, --flush [chain] Flush the selected chain (all the chains in the table if none is given). This is equivalent to deleting all the rules one by one.

iptables -X deletes a chain.

http://explainshell.com/explain?cmd=iptables+-X

-X, --delete-chain [chain] Delete the optional user-defined chain specified. There must be no references to the chain. If there are, you must delete or replace the referring rules before the chain can be deleted. The chain must be empty, i.e. not contain any rules. If no argument is given, it will attempt to delete every non-builtin chain in the table.

| improve this answer | |
  • 1
    Yes, I read the man page. What I want to know is if there is a difference. Cause the end result seems to be exactly the same. – Stéphane Jan 3 '15 at 19:25
  • The difference is the same as deleting all files in a directory, or the directory itself. – ptman Jan 3 '15 at 19:26
  • A rule is not the same as a chain. Edit: ptman explained it better :) – Cha0s Jan 3 '15 at 19:26
  • Yes. iptables -X deletes user defined chains – Cha0s Jan 3 '15 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.