Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to log all my outbound connections to a file using iptables.

This is my rule:

-A OUTPUT ! -o lo ! --destination  -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

However, if I add another IP destination (multicast) so my rule becomes this:

-A OUTPUT ! -o lo ! --destination ! --destination -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

I get the following error:

multiple -d flags not allowed

My question is not what does the error mean, but rather how can I exclude multiple IP addresses in my rule? The two conditions

! --destination


! --destination

are mutually exclusive so having two rules would effectively be like not having them at all (only worse, as I would get nearly twice the logs)

So is there an "and" operator?

share|improve this question
up vote 6 down vote accepted

For problems of this kind you can define new chains and jumping between them. You might for example add a chain LOGGING and at the beginning of this chain match those packets you don't want to log with an action of RETURN:

$ iptables -N LOGGING
$ iptables -A LOGGING -d -j RETURN
$ iptables -A LOGGING -d -j RETURN
$ iptables -A LOGGING -j LOG 
$ iptables -A OUTPUT -j LOGGING

This way, all packets coming through the OUTPUT chain would first go through the LOGGING chain and everything not being for and would be logged, then control would go back to the OUTPUT.

share|improve this answer

Yes, but it doesn't work the way you want. From the man page:

Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).

The way to do this is to add rules earlier in the chain to divert the traffic you don't want to log or modify, e.g.

-A OUTPUT --destination -j ACCEPT
-A OUTPUT  -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7
share|improve this answer
It should be possible to accept 2 answers. In the end I decided to give Andreas the reputation points. Thanks, though, and have an upvote! – Tom Macdonald Apr 5 '14 at 16:28
I thought about this answer, too, but the chain-approach has the advantage, that you don't infer with potential additional rules coming after the logging (probably you want to do further filtering and having ACCEPTed some addresses could mess with this). – Andreas Wiese Apr 5 '14 at 16:30
Thanks! Andreas's answer is cleaner, so the accept is well deserved. – Mikel Apr 5 '14 at 16:30
Oh, thank you. :) – Andreas Wiese Apr 5 '14 at 16:30

You can use comma separated values with -d or -s to set multiple IPs. (See discussion at http://www.gossamer-threads.com/lists/gentoo/user/210361)

For instance, command

sudo iptables -A OUTPUT -d, -j DROP

filters traffic to two servers.

share|improve this answer
Best answer, but bear in mind that doesn't work with '!'. – Nigel Horne Dec 29 '15 at 13:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.