I have this rule in my iptables:

iptables -A INPUT -p tcp -m tcp --dport 9191 -j DROP

Do I really need "-m tcp"? I already am using "-p tcp", so should I use "-m tcp" to be more secure?

1 Answer 1


With the -p tcp option the tcp module is already loaded and therefor it is somewhat redundant and not a must to use the -m tcp option and I don't see any reason why using this option would make the rule more secure.

Please see the iptables man page for a better understanding and comparison:

-p, --protocol [!] protocol

The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, icmp, or all, or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equivalent to all. Protocol all will match with all protocols and is taken as default when this option is omitted.


Match Extensions

iptables can use extended packet matching modules. These are loaded in two ways: implicitly, when -p or --protocol is specified, or with the -m or --match options, followed by the matching module name; after these, various extra command line options become available, depending on the specific module. You can specify multiple extended match modules in one line, and you can use the -h or --help options after the module has been specified to receive help specific to that module.

And for a list of available option with -p tcp see here:


As stated above, with the use of -m option it is possible to add extension modules and more matching options are then availble. For example the cpu module:


[!] --cpu number

Match cpu handling this packet. cpus are numbered from 0 to NR_CPUS-1 Can be used in combination with RPS (Remote Packet Steering) or multiqueue NICs to spread network traffic on different queues.


iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 -j REDIRECT --to-port 8081

Available since Linux 2.6.36.

Full list of iptables-extensions.

Additional question from OP: I dont understand what does -m match. What string? -m tcp matches what? It tries to find the word "tcp" where?

Answer: -m is for matching module name and not string. By using a particular module you get certain options to match. See the cpu module example above. With the -m tcp the module tcp is loaded. The tcp module allows certain options: --dport, --sport, --tcp-flags, --syn, --tcp-option to use in iptables rules. But using -p tcp already enables tcp module, that's why one can still use those options even without using -m tcp. Hope it clears all your confusion.

  • thank you so much, but would care to tell me what the -m would match against? For example, a normal TCP connection, -m would match against what string?Could you provide please an example of the string
    – Samul
    Jan 6, 2016 at 13:41
  • 1
    You are welcome. As you can see -m option is actually used to load extension modules that provides extra options. See my updateds answer and the link for example.
    – Diamond
    Jan 6, 2016 at 14:02
  • Thanks! :) One final thought: I think that in my case I should keep the "-m" correct? See this: iptables -A INPUT -p tcp -m tcp --dport 9191 -j DROP I use "--dport" and I think that it's only possible to use --ddport if I use -m correct?
    – Samul
    Jan 6, 2016 at 16:51
  • @Samul, Not really. You can just use it without the -m tcp option. --dport is part of the tcp module and will work with -p tcp only. Please refer to my answer again.
    – Diamond
    Jan 6, 2016 at 21:47
  • You are very kind, thank you! But see: I dont understand what does -m match. What string? -m tcp matches what? It tries to find the word "tcp" where?
    – Samul
    Jan 6, 2016 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .