I have an application on 2001 Port and i want allow some users with mac addresses to connect to this port. so i use this commands :

sudo iptables -A INPUT -p tcp --destination-port 2001 -j DROP

sudo iptables -A INPUT -p tcp --destination-port 2001 -m mac --mac-source [My PC mac] -j ACCEPT

service iptables save

it's block for everyone but not work for me (the mac address won't allow) what's the problem?


iptable rules are "first match" based. So your first rule drops everything and the second rule is never reached.

If you change the order ("accept" first, the "drop" second) it'll do what you expect.


Your IPtables rules are in conflict. IPtables works on a first-match basis. Using the -A option puts a rule at the end of the list so your ACCEPT rule is at the end.

Thus if you entered your rules in the order you described your packet that matches that description (a tcp connection at port 2001) it will be dropped and will not concern itself with any of the following rules. That is of course if these are your only rules too!

I understand that this link is pretty old, however it provides excellent information on how IPtables priority of rules works.

So you will want to clear out that rule. First you need to identify the rule, then delete it.

sudo iptables -L --line-numbers    
sudo iptables -D INPUT [The Number of the Drop Rule]

Next you can re-add the rule like you did before using the -A option. Now your IPtables should work as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.