Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer STEAL over DROP, so I checked the manual, but there's only the following info:

       Like the DROP target, but does not throw an error like DROP when used
       in the OUTPUT chain.

Does anyone know what error? For example, we could take the two following rules:

-A OUTPUT --protocol tcp --match multiport ! --dports 80,443 --match set --match-set bt_level1 dst --jump STEAL


-A OUTPUT --protocol tcp --match multiport ! --dports 80,443 --match set --match-set bt_level1 dst --jump DROP 

What is the difference between them?

share|improve this question

Drop sends an error packet when used with the OUTPUT chain. Kind of like how REJECT returns an error packet when used with the INPUT chain. STEAL doesn't.

EDIT: Per bahamat, the IPtables extensions are in fact done by the netfilter team.

share|improve this answer
These extensions are provided by the netfilter team. They in fact write iptables and the kernel modules that go along with it. The code isn't outside because it's by untrusted party. It's because the code is experimental. – bahamat Jan 17 '14 at 17:44
Good to know, I was under the impression it was maintained by an outside group. – rfelsburg Jan 17 '14 at 17:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.