48.9.3. Command Options for IPTables

Many iptables commands have the following structure:

iptables [-t <table-name>] <command> <chain-name> \
			<parameter-1> <option-1> \
			<parameter-n> <option-n>

iptables [-t <table-name>] <command> <chain-name> \
			<parameter-1> <option-1> \
			<parameter-n> <option-n>

<table-name> — Specifies which table the rule applies to. If omitted, the filter table is used.

<command> — Specifies the action to perform, such as appending or deleting a rule.

<chain-name> — Specifies the chain to edit, create, or delete.

<parameter>-<option> pairs — Parameters and associated options that specify how to process a packet that matches the rule.

The length and complexity of an iptables command can change significantly, based on its purpose.

For example, a command to remove a rule from a chain can be very short:

iptables -D <chain-name> <line-number>

In contrast, a command that adds a rule which filters packets from a particular subnet using a variety of specific parameters and options can be rather long. When constructing iptables commands, it is important to remember that some parameters and options require further parameters and options to construct a valid rule. This can produce a cascading effect, with the further parameters requiring yet more parameters. Until every parameter and option that requires another set of options is satisfied, the rule is not valid.

Type iptables -h to view a comprehensive list of iptables command structures.