Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would one modify the following line in iptables file (debian)?

ACCEPT     all  --  XXX.XXX.XX.X         anywhere            PHYSDEV match --physdev-in vif3.1 


ACCEPT     all  --  YYY.YYY.YY.Y         anywhere            PHYSDEV match --physdev-in vif3.1 

I looked up the https://wiki.debian.org/iptables and I'm having hard time figuring out how to exactly do this modification. Can it be done using one command, or there is a way to temporally "extract" the iptables file and modify it using nano or vi, and put it back in place?

share|improve this question

migrated from serverfault.com Nov 8 '13 at 23:04

This question came from our site for system and network administrators.

up vote 5 down vote accepted

To replace that particular rule using iptables you need to do some debugging first.

First option is replacing the rule instantly.

1) See what line-number and in what CHAIN the mentioned line is placed. e.g:

iptables -L -v -n --line-n

2) Locate the line and replace it based on the output.

iptables -R [CHAIN_NAME] [LINE_NUMBER] -s YYY.YYY.YYY.YYY -m physdev  --physdev-in vif3.1  -j ACCEPT

Second option is to save the iptables rules and modify the file and import it.

1) Save the rules.

iptables-save > my_ipt-$(date +%F).ipt

2) Modify the my_ipt-$(date +$F).ipt

3) import the my_ipt-$(date +%F).ipt

iptables-restore < my_ipt-$(date +%F).ipt

NOTE: $(date +%F) is the date you saved the file e.g: 2013-11-07

Check if everything is as expected

iptables -L -v -n --line-n
share|improve this answer
thank you my good man for this detailed answer. :) – Rene Brakus Nov 7 '13 at 9:12

Yes it is possible : iptables -L CHAIN -n -v --line-numbers give you the index in the rules iptables -S CHAIN INDEX display the rule

Edit With -R CHAIN INDEX parameters.

Exemple : iptables -L Visioconf-OUT -n -v --line-numbers

Chain Visioconf-OUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1     719K   49M LOG        all  --  *      *              LOG flags 0 level 4 prefix "DROP4 Visioconf-OUT "
2     719K   49M DROP       all  --  *      *  

iptables -S Visioconf-OUT 2

-A Visioconf-OUT -j DROP

iptables -R Visioconf-OUT 2 -s -j DROP

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.