Is there a way to view iptables rules in a bit more detail?

I recently added masquerade to a range of IPs:

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
service iptables save
service iptables restart

Which has done what I want it to, but when I use:

iptables -L

I get the same output as I normally get:

Chain INPUT (policy ACCEPT)
target    prot opt source        destination

Chain FORWARD (policy ACCEPT)
target    prot opt source        destination

Chain OUTPUT (policy ACCEPT)
target    prot opt source        destination

How can I see the rules including the ones I add? (system is CentOS 6)


8 Answers 8


When using the -L, --list option to list the current firewall rules, you also need to specify the appropriate Netfilter table (one of filter, nat, mangle, raw or security). So, if you’ve added a rule for the nat table, you should explicitly specify this table using the -t, --table option:

iptables --table nat --list

Or using the options short form:

iptables -t nat -L

If you don’t specify a specific table, the filter table is used as the default.

For faster results, it can be useful to also include the -n, --numeric option to print numeric IP addresses instead of hostnames, thus avoiding the need to wait for reverse DNS lookups.

You can get even more information by including the -v, --verbose option.


iptables controls five different tables: filter, nat, mangle, raw and security. On a given call, iptables only displays or modifies one of these tables, specified by the argument to the option -t (defaulting to filter). To see the complete state of the firewall, you need to call iptables on each of the tables successively.

Additionally, to get an accurate representation of the rules, you need to pass the option -v. Otherwise some important criteria are omitted in the output, such as the interface in filter rules (e.g. a rule that says “accept everything” and a rule that says “accept everything on the loopback interface” can only be distinguished with -v).

Thus, to get a complete presentation of the netfilter rules, you need

iptables -vL -t filter
iptables -vL -t nat
iptables -vL -t mangle
iptables -vL -t raw
iptables -vL -t security

Alternatively, you can call the iptables-save program, which displays all the rules in all tables in a format that can be parsed by iptables-restore. This format is also reasonably readable by humans (it's pretty much like a series of calls to the iptables command to build the table).

  • filter, nat, mangle, raw, security... and mark looks like another one. Having a hard time finding a way to list all the tables, especially if some are system dependent. Someone asked the same thing a while ago with no real answer: comp.os.linux.networking.narkive.com/fDfacHDC/…
    – tarabyte
    Commented Apr 22, 2022 at 21:23
  • Running iptables -vL -t nat as sudo is just showing the rules after loading for 15 seconds and I am not getting the prompt back. If I use sudo iptables -t nat -nvL, the rules instantly shows up. This is on Debian 11 Commented May 24 at 14:57

iptables -S does the trick for me. It seems to list all the active rules, even when the service is off.

From the man page:

-S, --list-rules [chain] Print all rules in the selected chain. If no chain is selected, all chains are printed like iptables-save. Like every other iptables command, it applies to the specified table (filter is the default).

  • This is a really kwl answer, I've also noticed that /sbin/service iptables status gives a similar output Commented Apr 1, 2016 at 10:08
  • 6
    +1. No 'seems' about it- from the man page: "-S, Print all rules in the selected chain. If no chain is selected, all chains are printed like iptables-save". This is the one I usually need.
    – Mike S
    Commented May 11, 2016 at 21:27
  • 12
    i did not find this to be the case. iptables -S does not show all my nat rules, which i can see when i run iptables -L -t nat Commented Apr 8, 2017 at 1:34
  • 2
    @MikeS From the man page, BOTH commands operate only on the specified table, filter by default. "Like every other iptables command, it applies to the specified table (filter is the default)." The wording in the documentation is copied almost identically for -S and -L, they only differ in formatting of the output, not the rules printed. This is true at least on Ubuntu 16.04 which on my system is iptables v1.6.0.
    – Scott
    Commented Jun 18, 2017 at 3:15
  • 3
    Agree with @mulllhausen here. I needed "sudo iptables --table nat --list" to show my nat table rules. the "-S" flag by itself did not show them. Commented Aug 18, 2017 at 19:54

What I do is to execute iptables-save > iptables_bckp, this would backup all the layers, then edit the file and restore the iptables iptables-restore < iptables_bckp

# iptables-save > iptables_bckp
# vim iptables_bckp
# iptables-restore < iptables_bckp

You can make a double backup so you modify one of them without losing your past iptables.

This is a personal practice, I'm not saying this is the best way but for me works great.

Give a try

  • 1
    This is the only realistic answer I have found so far that actually dumps all of the tables too. Commented May 28, 2017 at 0:50

You can use:

# lsmod | grep ip_tables
ip_tables              13193  4 iptable_raw,iptable_mangle,iptable_nat,iptable_filter

To find all tables and show specific rule in table.

  • 2
    A better way to find the table names is cat /proc/net/ip_tables_names and cat /proc/net/ip6_tables_names Commented Feb 5, 2020 at 10:43

The iptables command also requires you to specify the table otherwise it defaults to filter table. So try:

iptables -t nat -L

If it will really help you could write a bash script and put it in a folder that is reference by your path or reference it via an alias in the ~/.bashrc file.



 echo "Filter table:"
 iptables -t filter -vL

 echo "Nat table:"
 iptables -t nat -vL

 echo "Mangle table:"
 iptables -t mangle -vL

 echo "Raw table:"
 iptables -t raw -vL

 echo "Security table:"
 iptables -t security -vL

 echo "All rules in all tables printed"

Remember to give your new bash script execute permissions with chmod

If permission is an issue you may have to add sudo in front of all the iptables commands.

iptables -vnxL
iptables -vnxL -tnat

possibly additionally, though these are very very rarely used:

iptables -vnxL -traw
iptables -vnxL -tmangle
iptables -vnxL -tsecuriy

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .