I'm reading iptables' man page at https://linux.die.net/man/8/iptables, and I've got a question regarding the use of user-defined chains:

In the Targets section, it says

If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

And underneath in the Options section, it also says

Only built-in (non-user-defined) chains can have policies, and neither built-in nor user-defined chains can be policy targets.

So my question is, what happens when a packet goes into a user-defined chain, and reaches the end without matching any of the rules? In other words, what is the default action of a user-defined chain?

The reason I'm asking is I'm wondering if it's necessary to add a catch-all rule to the end of every user-defined chain. Something like

iptables -A MY-CHAIN -j RETURN

Or is this the default behavior? Or something else?


If none of the rules in a user-defined chain match, the default behavior is effectively RETURN: processing will continue at the next rule in the parent chain.

When a packet matches a rule whose target is a user-defined chain, the packet begins traversing the rules in that user-defined chain. If that chain doesn't decide the fate of the packet, then once traversal on that chain has finished, traversal resumes on the next rule in the current chain.

(from the Linux 2.4 Packet Filtering HOWTO)

  • Thanks. I will trust you although it would be better if you can include a source – cyqsimon Nov 14 '19 at 2:56
  • 1
    Added a source :). – larsks Nov 14 '19 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.