Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did iptables-save followed by iptables -F and the application started working.) There are way too many rules to sort through manually. Can I do something to show me which rule is dropping the packets?

share|improve this question
fedorahosted.org/dropwatch might also be helpful in the future. – Shawn J. Goff Jul 25 '13 at 18:41
To see the counters update in real time use<br/> <code> watch iptables -L -v -n </code> – Chris Gibb Jul 13 '14 at 13:35
up vote 12 down vote accepted

You could add a TRACE rule early in the chain to log every rule that the packet traverses.

I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic.

How is the firewall built? It may be easier to look at the builder rules than the built rules.

share|improve this answer
I figured out after asking this question that the rules are from APF, and I was able to fix that. I love the TRACE target, though. That would have been very effective. – Shawn J. Goff Mar 26 '11 at 19:21
An example of using TRACE target is here: serverfault.com/questions/122157/debugger-for-iptables/…. – slm Jun 12 '15 at 16:59

Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.

share|improve this answer
This is good, I'm hoping for something better since there are 1000 rules and 1000s of dropped packets. – Shawn J. Goff Mar 26 '11 at 17:49
Use sort to sort rules by packet counter. – ninjalj Mar 26 '11 at 17:53

Since iptables -L -v -n has counters you could do the following.

iptables -L -v -n > Sample1
#Cause the packet that you suspect is being dropped by iptables
iptables -L -v -n > Sample2
diff Sample1 Sample2

This way you will see only the rules that incremented.

share|improve this answer

In my company we use watch -n 2 -d iptables -nvL, it shows changes between requests

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.