As per my understanding iptables work on transport layer (layer 4) and any packet filtering that happens is based on the ip protocols for layer 4 like tcp and udp. So if we enter protocols like esp, gre and l2tp in iptables -p option, does that make any sense? Can we filter packets based on layer 2/3 protocols using iptables? If not, then how does iptables filter packets based on icmp protocols?

New to iptables and I'm still learning. Thanks!

1 Answer 1


iptables supports filtering at the datalink, network and transport layers.

The -p (protocol) option is not specifically limited to layer 4 protocols. The man page mentions icmp and esp specifically. I know that gre is also supported as well (either as 'gre' or protocol '47'). The specified protocol can be passed to this option by name or by its integer number specified in /etc/protocols. I am not sure that all protocols in this list are supported by iptables.

If the -p or --protocol was specified and if and only if an unknown option is encountered, iptables will try load a match module of the same name as the protocol, to try making the option available.

This 'match module' syntax is the extended packet matching module and would be specified by using the -m --match options.

You can find a list of the supported extensions here: iptables-extensions. A list of the available netfilter kernel modules are located at /lib/modules/$(uname -r)/kernel/net/netfilter.

  • And of course, non-ip protocols (e.g. Novell IPX/SPX or AppleTalk) will not be seen by iptables but ebtables can match and filter at least the protocol identifier itself.
    – Ben Voigt
    Aug 10, 2020 at 20:24
  • Hi, thanks for the answer. I completely overlooked the netfilter packet flow diagram. So, if a udp packet which has l2tp over ipsec protocol in the underlying layer, can iptables process that packet at layer 2 if we use iptables -p l2tp or iptables -p esp? That was my question. Most of the implementations I see online process packets only based on udp/tcp packets. That's what made me confused. I apologize if this questions seems to naive.
    – parsing
    Aug 11, 2020 at 4:45
  • 1
    Take a look at the -m esp --espspi module match option on the esp module and the -m policy policy module options (there are many match options for this module). You can match on ipsec encapsulation protocols, source and destination for tunnel mode. I am not quite sure if you can descend into the l2tp traffic however and match based on mac address of the encapsulated traffic, but some testing would prove that out easy enough. These module descriptions are found in the second link in the answer above.
    – 111---
    Aug 11, 2020 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .