10

The help information doesn't seem to be very informative:

--list    -L [chain [rulenum]]
      List the rules in a chain or all chains
--list-rules -S [chain [rulenum]]
      Print the rules in a chain or all chains

The only difference is in the choice of word: "list" vs. "print".

THe manual is a bit more detailed but still doesn't help:

   -L, --list [chain]
          List all rules in the selected chain.  If no chain is selected, all chains are listed. Like every other iptables command, it applies to the specified table (filter  is  the  default),  so  NAT
          rules get listed by
           iptables -t nat -n -L
          Please note that it is often used with the -n option, in order to avoid long reverse DNS lookups.  It is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atom‐
          ically listed and zeroed.  The exact output is affected by the other arguments given. The exact rules are suppressed until you use
           iptables -L -v

   -S, --list-rules [chain]
          Print all rules in the selected chain.  If no chain is selected, all chains are printed like iptables-save. Like every other iptables command, it applies to the specified table (filter is  the
          default).

Seems to me that -S is actually more detailed and printed out the exact ports that I allowed with a --dports argument. But why is that the case? I don't think the word "print" automatically suggests a higher level of details than "list"?

1 Answer 1

12

The difference is the output format. The -S option produces in the the fashion of iptables-save. And this can be reused with iptables-apply,iptables-restore. (Check their man pages entries for details.) So you can think of the difference as:

  • -L is for reference, to get a clue of what's there
  • -S is for reusable output, which is for machine parsing

If you think the -S option gives more details, then you should learn other iptables parameters that provide more details in combination with -L.

2
  • the output format of iptables -S and iptables-save is different. Any idea why? Commented Nov 6, 2019 at 14:39
  • 1
    @CiprianTomoiagă From what I can see on my Debian, the default for -S is just one table, while the other command saves all tables. Also, there are no counters. See the diff on your system and start a new question if there's one.
    – user147505
    Commented Nov 6, 2019 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .