How can I consolidate this two rules in just one iptables rule?

iptables -A FORWARD -d -j ACCEPT
iptables -A FORWARD -s -j ACCEPT


What I was looking here was some way to get something similar to tcpdump host (match source or destination in one parameter/rule).

Thanks for @Zoredache who stated that such thing doesn't exist in iptables. What motivated my question was that was hard to believe that when I googled it I didn't find anything (and such synteax sugar could simplify/reduce iptables rules set a lot in some cases), so I asked this question here to be sure.

I thought that this is a fair question and that is correct to downvote anybody that try to give an answer that clearly doesn't address my simple question.

Was not my intention be rude neither offend anybody who was trying to help, I was just trying to encourage pertinent and good answers (like what @Zoredache gave me) on this site. How people react to my downvote show me that such attitudes aren't the way to go in this community and I apologize for that.

closed as off-topic by Wesley, Katherine Villyard, Jenny D says Reinstate Monica, mdpc, Ward - Reinstate Monica Sep 25 '16 at 4:09

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Why do you need to do that ? – user9517 supports GoFundMonica Sep 7 '16 at 20:46
  • I don't want have two rules and I can't use connection track... RELATED, ... – gsi-frank Sep 7 '16 at 21:17
  • 4
    I'm voting to close this question closed because the author is angry that magic doesn't exist. – Wesley Sep 7 '16 at 21:55
  • I'm not angry at all, I just don't like when people redact answers that are not related at all with the original question, and I think that downvote are for that and that my comment was not showing angry in any way. I even upvote his comment in which he wrote a real answer to this question. I'm really impressed of the reaction to a legitimate downtime as well good intentioned comment. – gsi-frank Sep 7 '16 at 22:23

You simply can't do this using the basic filtering. What utility do you think it would provide? How is having two rules a problem?

The closest solution would probably be to use an ipset then write a rule that did a --match-set. But using a set would probably require running even more commands, and probably wouldn't give you any performance improvements or anything.

  • This is all what I was looking for: "You simply can't do this using the basic filtering" Thanks a lot! – gsi-frank Sep 7 '16 at 22:25

Well, you can define it only once, if that is enough for your purposes:

for h in ; do
                              iptables -A FORWARD -d $h -j ACCEPT
                              iptables -A FORWARD -s $h -j ACCEPT
  • I will still end with two iptables rules, I was clear that I'm trying to get just one iptable rule ;) – gsi-frank Sep 7 '16 at 21:26
  • 4
    I understood you perfectly well. tcpdump has an inbuilt "source or destination" keyword, but (unfortunately for you, apparently) iptables doesn't. There is no "or" construct possible either, unless you create several different chains and "jump" or "goto" them. As for the downvote, it's probably the most useful answer you'll get. If you deign to explain why you can't work with two rules, someone might have an idea. – Law29 Sep 7 '16 at 21:32
  • 3
    @gsi-frank seriously, people aren't sitting here watching the site, waiting to give you answers. Sure you asked a question, and had to wait a whole 8 minutes for a reply? Maybe Law29 was doing something else, answering another question or something else. Perhaps you need to be a bit patient. – Zoredache Sep 7 '16 at 21:50
  • 3
    @gsi-frank You didn't reply to Zoredache after 4 minutes. It's a shame I had to downvote your question for that. – Wesley Sep 7 '16 at 21:55
  • Are you seriously??!! Why do you think that my downvote is related at all to push Law29 to give me a answer quickly and not to discourage the writing of answers in this site that not solve at all a very crear question? Pls read carefully what was my question and what was the @Law29 reply, he evidently didn't reply at all my question at all, and that was the only reason why I downvote. Was latter in a comment when he addressed my question and.... bum! I upvote his comment and made that comment as a way to alert Law29 that he was wasting his time and mine with such initial answer. – gsi-frank Sep 7 '16 at 22:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.