I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer STEAL over DROP, so I checked the manual, but there's only the following info:

       Like the DROP target, but does not throw an error like DROP when used
       in the OUTPUT chain.

Does anyone know what error? For example, we could take the two following rules:

-A OUTPUT --protocol tcp --match multiport ! --dports 80,443 --match set --match-set bt_level1 dst --jump STEAL


-A OUTPUT --protocol tcp --match multiport ! --dports 80,443 --match set --match-set bt_level1 dst --jump DROP 

What is the difference between them?

1 Answer 1


Drop sends an error packet when used with the OUTPUT chain. Kind of like how REJECT returns an error packet when used with the INPUT chain. STEAL doesn't.

EDIT: Per bahamat, the IPtables extensions are in fact done by the netfilter team.

  • 1
    These extensions are provided by the netfilter team. They in fact write iptables and the kernel modules that go along with it. The code isn't outside because it's by untrusted party. It's because the code is experimental.
    – bahamat
    Jan 17, 2014 at 17:44
  • Good to know, I was under the impression it was maintained by an outside group.
    – rfelsburg
    Jan 17, 2014 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .