Find the answer to your Linux question:
Results 1 to 5 of 5
Below, what is the difference between using -m to specify a tcp match as well as -p to specify tcp protocol instead of just using -p to specify the tcp ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Sep 2011
    Posts
    3

    iptables; match and protocol question


    Below, what is the difference between using -m to specify a tcp match as well as -p to specify tcp protocol instead of just using -p to specify the tcp protocol?

    iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

    iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT


    Is there a difference? What does specifying a match of "-m tcp" do for us that "-p tcp" by itself doesn't?

    Appreciate any help or thoughts

  2. #2
    Linux Guru Lazydog's Avatar
    Join Date
    Jun 2004
    Location
    The Keystone State
    Posts
    2,677
    That is a good question. I have never setup rules that use both as I do not believe it is required. I haven't found anything in the tutorial I have that would state anything about this use.

    Regards
    Robert

    Linux
    The adventure of a life time.

    Linux User #296285
    Get Counted

  3. #3
    Just Joined!
    Join Date
    Jan 2013
    Posts
    8
    If you have an option (e.g. --dport) for an iptables module (e.g. -m tcp) that you have not specified (as in your second command), iptables will assume the the module of whatever you specify as your protocol. In this case, tcp.

    To quote the iptables-extensions man page: "If the -p or --protocol was specified and if and only if an unknown option is encountered, iptables will try load a match module of the same name as the protocol, to try making the option available."

    Also, in your first command, the --dport 22 should come after -m tcp. Otherwise it's just falling back to the aforementioned rule, and you're loading the tcp module but not doing anything with it. ...Or you could just not specify -m tcp at all and use the second command.

  4. $spacer_open
    $spacer_close
  5. #4
    Linux Guru Lazydog's Avatar
    Join Date
    Jun 2004
    Location
    The Keystone State
    Posts
    2,677
    @quovadisnp

    I did some research on this topic.
    There are
    Implicit matches which do not require the '-m' module flag.
    and then there is
    Explicit matches for which the '-m' module flag is required.

    You can read more here, MATCHES

    Regards
    Robert

    Linux
    The adventure of a life time.

    Linux User #296285
    Get Counted

  6. #5
    Just Joined!
    Join Date
    Jan 2013
    Posts
    8
    Note that all the "implicit matches" are protocols, as I stated previously. Nice find, though.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •