Red Hat LINUX 7.2 Reference Manual page 301

Section 18.3:Options Used in iptables Commands
• -h — Provides a list of helpful command structures, as well as a quick summary of command
parameters and options.
• -I — Inserts a rule in a chain at a particular point. Assign a number to the rule to be inserted and
iptables will put it there. If no number is specified, iptables will place your command at
the top of the rule list.
Be aware of which option (-A or -I) you are using when adding a rule.
The order of the rules can be very important when determining if a par-
ticular packet applies to one rule or another. Make sure when adding a
rule to the beginning or end of the chain that it does not affect other rules
in that chain.
• -L — Lists all of the rules in the chain specified after the command. To list all rules in all chains in
the default filter table, do not specify a chain or table. Otherwise, the following syntax should
be used to list the rules in a specific chain in a particular table:
iptables -L <chain-name> -t <table-name>
Powerful options for the -L command that provide rule numbers and allow more verbose rule
descriptions, among others, are described in Section 18.3.7, Listing Options.
• -N — Creates a new chain with a user-specified name.
• -P — Sets the default policy for a particular chain, so that when packets traverse an entire chain
without matching a rule, they will be sent on to a particular target, such as ACCEPT or DROP.
• -R — Replaces a rule in a particular chain. You must use a rule's number after the chain's name
to replace that rule. The first rule in a chain relates to rule number 1.
• -X — Deletes a user-specified chain. Deleting a built-in chain for any table is not allowed.
• -Z — Zeros the byte and packet counters in all chains for a particular table.
18.3.4 Parameters
Once certain iptables commands are specified, including those used to add, append, delete, insert,
or replace rules within a particular chain, parameters are required to begin the construction of the
packet filtering rule.
• -c Resets the counters for a particular rule. This parameter accepts the PKTS and BYTES options
to specify what counter to reset.
CAUTION
301