I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did iptables-save followed by iptables -F and the application started working.) There are way too many rules to sort through manually. Can I do something to show me which rule is dropping the packets?

  • 1
    fedorahosted.org/dropwatch might also be helpful in the future. Jul 25, 2013 at 18:41
  • To see the counters update in real time use<br/> <code> watch iptables -L -v -n </code>
    – Chris Gibb
    Jul 13, 2014 at 13:35
  • You can also use the iptables -nvL -t filter command to display only the rules in the filter table, which is where most packet-filtering rules are located.
    – Shayan
    Dec 26, 2022 at 20:30

5 Answers 5


You could add a TRACE rule early in the chain to log every rule that the packet traverses.

I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic.

How is the firewall built? It may be easier to look at the builder rules than the built rules.


Since iptables -L -v -n has counters you could do the following.

iptables -L -v -n > Sample1
#Cause the packet that you suspect is being dropped by iptables
iptables -L -v -n > Sample2
diff Sample1 Sample2

This way you will see only the rules that incremented.


Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.

  • 1
    This is good, I'm hoping for something better since there are 1000 rules and 1000s of dropped packets. Mar 26, 2011 at 17:49
  • Use sort to sort rules by packet counter.
    – ninjalj
    Mar 26, 2011 at 17:53

In my company we use watch -n 2 -d iptables -nvL, it shows changes between requests

watch -n1 -d "iptables -tfilter -vnxL | grep -vE 'pkts|Chain' | sort -nk1hr | column -t"

Keep in mind, this will only show stuff for the table filter.

If you want all tables, try this:

watch -n1 -d "(iptables -tfilter -vnxL;iptables -tnat -vnxL;iptables -tmangle -vnxL;iptables -traw -vnxL;iptables -tsecurity -vnxL) | grep -vE 'pkts|Chain' | sort -nk1,1hr | column -t"
  • 1
    The most complete solution IMHO. | tac can be dropped in favour of add -r to the sort command.
    – Zaar Hai
    Jul 26, 2021 at 4:52
  • 1
    @ZaarHai thanks for the flowers, edited considering your input and also fixed the sorting which lacked -h.
    – sjas
    Jul 31, 2021 at 17:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .