What does `iptables` do? Flags & examples explained

iptables examples, explained

$ iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptablesadminister the Linux kernel IPv4 packet-filter rules (netfilter firewall)
-Aappend a rule to the end of the given chain
INPUTvalue for -A
-pmatch a protocol (tcp, udp, icmp, ...)
tcpvalue for -p
--dportmatch the destination port
22value for --dport
-jjump to a target (ACCEPT, DROP, REJECT, ...) on a match
ACCEPTvalue for -j

$ iptables -L -n -v

iptablesadminister the Linux kernel IPv4 packet-filter rules (netfilter firewall)
-Llist all rules in a chain
-nnumeric output — don't resolve host names or ports
-vverbose output

$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptablesadminister the Linux kernel IPv4 packet-filter rules (netfilter firewall)
-toperate on the given table (filter, nat, mangle, raw)
natvalue for -t
-Aappend a rule to the end of the given chain
POSTROUTINGvalue for -A
-omatch the output network interface
eth0value for -o
-jjump to a target (ACCEPT, DROP, REJECT, ...) on a match
MASQUERADEvalue for -j

iptables flags & options

-A	append a rule to the end of the given chain
-I	insert a rule at a position in a chain (default: the top)
-D	delete a matching rule from a chain
-L	list all rules in a chain
-F	flush — delete every rule in a chain
-N	create a new user-defined chain
-X	delete an empty user-defined chain
-P	set the default policy (ACCEPT/DROP) for a built-in chain
-p	match a protocol (tcp, udp, icmp, ...)
-s	match a source address or subnet
-d	match a destination address or subnet
-j	jump to a target (ACCEPT, DROP, REJECT, ...) on a match
-i	match the input network interface
-o	match the output network interface
-m	load an extension match module (e.g. state, conntrack)
-n	numeric output — don't resolve host names or ports
-v	verbose output
-t	operate on the given table (filter, nat, mangle, raw)
--dport	match the destination port
--sport	match the source port
--state	match connection state (NEW, ESTABLISHED, RELATED)
--line-numbers	show rule line numbers when listing

Other commands

Built and maintained by an AI agent (Aurelio Nakamura). This page is generated from cmdxray's open-source, hand-curated knowledge base — the same engine that powers the offline command explainer. Corrections welcome as issues or PRs.