I'm using iptables mangle to mark traffic with different DSCP values. I'd like to confirm the order in which overlapping rules will be applied. I assumed that the logic would be the same as with iptables generally: the first matching rule in the chain would be applied. But in fact it seems to be the reverse. For example with the following rules:

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DSCP       icmp --  anywhere             anywhere            DSCP set 0x14 
DSCP       all  --  anywhere             anywhere            DSCP set 0x0f 

I assumed that ICMP packets would be marked with 0x14, but they are in fact marked with 0x0f. Can I trust this always to be the case? That the last matching rule in the chain will be applied instead of the last one? I could not find documentation about this anywhere.

1 Answer 1


If I remember correctly the DSCP target in the mangle table doesn't stop processing of rules (unlike the ACCEPT/REJECT/DROP targets). So in your case, the DSCP value is set to 0x14 for an ICMP packet and then overwritten with 0x0f in the next rule (as it matches as well).

I would suggest ordering the rules from least to most specific so that the most specific ones are applied last.

  • If the DSCP target doesn't stop the chain, that would explain the behavior. I just wanted to make sure it's consistent, and I guess it is. Thanks
    – Sampo
    Sep 16, 2015 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .