2

I`ve two rules. First blocked all port from range:

-A INPUT -m state --state NEW -m tcp -p tcp --match multiport --dports 200:65535 -j DROP

and second open one in this range:

-A INPUT -i eth0 -p tcp --dport 5901 -m state --state NEW,ESTABLISHED -j ACCEPT

but it doesn`t work. Anyone know why?

Improve this question

1 Answer 1

Reset to default
6

IIRC iptables rules are order dependent: if the first rule matches, it won't parse any more. Reverse the order and you should achieve what you're trying to do.

Extension: it is not always so, some rules (f.e. -j LOG) allows the packet processing to go further. But the common ACCEPT, REJECT, etc. rules aren't. Best if you see iptables as if it were a procedural programming language: rules are tried-to-match and executed in always linearly, in order.

Improve this answer
2
  • yes as @shearn89 told, iptables evaluate the rules from top
    – c4f4t0r
    Jan 22, 2015 at 10:49
  • This is indeed how it works. If you see it as a procedural language, then custom chains are procedures/functions, which you can call from other rules. There even is a RETURN target which you can use to return from a procedure to where it was called from.
    – kasperd
    Jan 22, 2015 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.