iptables – How to Specify Multiple Rules in Linux Firewall

firewalliptableslinux

The manpage says (emphasis mine):

-A, --append chain rule-specification
        Append one *or more* rules to the end of the selected chain.
[...]
-D, --delete chain rule-specification
        Delete one *or more* rules from the selected chain.
[...]
-I, --insert chain [rulenum] rule-specification
       Insert one *or more* rules in the selected chain as the [...]

Does the manpage say that we can add more than one rule per invocation of iptables? Because I cannot find the right syntax to do it. This:

iptables -D INPUT -s 1.1.1.1 -p tcp -j DROP -s 1.1.1.2 -p tcp -j DROP

results in "multiple -s flags not allowed" error. This:

iptables -D INPUT -s 1.1.1.1 -p tcp -j DROP -D INPUT -s 1.1.1.2 -p tcp -j DROP

results in "Cannot use -D with -D" error. Adding "–" also doesn't help.

So can we add multiple rules per invocation?

Best Answer

You didn't quote the rest of the man page which clarifies this, i.e.:

       -A, --append chain rule-specification
          Append one or more rules to the end of the selected chain.  When the source  and/or  destina‐
          tion  names  resolve to more than one address, a rule will be added for each possible address
          combination.

This implies that multiple rules are added by virtue of using a source or destination hostname in a rule specification that resolves to multiple addresses, not that you can add multiple distinct rules in one invocation.

Related Topic