Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to log all my outbound connections to a file using iptables.

This is my rule:

-A OUTPUT ! -o lo ! --destination  -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

However, if I add another IP destination (multicast) so my rule becomes this:

-A OUTPUT ! -o lo ! --destination ! --destination -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

I get the following error:

multiple -d flags not allowed

My question is not what does the error mean, but rather how can I exclude multiple IP addresses in my rule? The two conditions

! --destination


! --destination

are mutually exclusive so having two rules would effectively be like not having them at all (only worse, as I would get nearly twice the logs)

So is there an "and" operator?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

For problems of this kind you can define new chains and jumping between them. You might for example add a chain LOGGING and at the beginning of this chain match those packets you don't want to log with an action of RETURN:

$ iptables -N LOGGING
$ iptables -A LOGGING -d -j RETURN
$ iptables -A LOGGING -d -j RETURN
$ iptables -A LOGGING -j LOG 
$ iptables -A OUTPUT -j LOGGING

This way, all packets coming through the OUTPUT chain would first go through the LOGGING chain and everything not being for and would be logged, then control would go back to the OUTPUT.

share|improve this answer

Yes, but it doesn't work the way you want. From the man page:

Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).

The way to do this is to add rules earlier in the chain to divert the traffic you don't want to log or modify, e.g.

-A OUTPUT --destination -j ACCEPT
-A OUTPUT  -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7
share|improve this answer
It should be possible to accept 2 answers. In the end I decided to give Andreas the reputation points. Thanks, though, and have an upvote! –  Tom Macdonald Apr 5 '14 at 16:28
I thought about this answer, too, but the chain-approach has the advantage, that you don't infer with potential additional rules coming after the logging (probably you want to do further filtering and having ACCEPTed some addresses could mess with this). –  Andreas Wiese Apr 5 '14 at 16:30
Thanks! Andreas's answer is cleaner, so the accept is well deserved. –  Mikel Apr 5 '14 at 16:30
Oh, thank you. :) –  Andreas Wiese Apr 5 '14 at 16:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.