1

Rules in iptables/ip6tables can sometimes become a bit verbose to read. I am looking for a list of information that I can skip from iptables/ip6tables that I write.

Examples:

  • if you say -s 1.2.3.4 it implies --mask 255.255.255.255, i.e. it matches only the exact IPv4 address. Similar stuff exists in the IPv6 realm.
  • if you say -p tcp --dport http this implies -m tcp, the same can be done for the udp module, i.e. --dport and --sport imply the respective module as long the protocol in -p matches.

Rationale: The number of implied data for a rule should be finite, which means this isn't an open-ended question, which I had pondered before typing it up.

NB: you can see what's implied for the rules you write by comparing your input with the output if iptables-save/ip6tables-save. Alas, the problem is that I cannot write up every possible rule, so I am looking for a list or specifically documentation outlining what data is implied.

0

You must log in to answer this question.

Browse other questions tagged .