Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Rules in iptables/ip6tables can sometimes become a bit verbose to read. I am looking for a list of information that I can skip from iptables/ip6tables that I write.


  • if you say -s it implies --mask, i.e. it matches only the exact IPv4 address. Similar stuff exists in the IPv6 realm.
  • if you say -p tcp --dport http this implies -m tcp, the same can be done for the udp module, i.e. --dport and --sport imply the respective module as long the protocol in -p matches.

Rationale: The number of implied data for a rule should be finite, which means this isn't an open-ended question, which I had pondered before typing it up.

NB: you can see what's implied for the rules you write by comparing your input with the output if iptables-save/ip6tables-save. Alas, the problem is that I cannot write up every possible rule, so I am looking for a list or specifically documentation outlining what data is implied.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.