Iptables: Invert IP, Protocol, Or Interface Test With !

by on January 29, 2010 · 4 comments· LAST UPDATED January 29, 2010


How do I invert a protocol or ip address test while writing iptables based shell scripts?

The iptables command comes with ! operator. The most of these rules can be preceded by a ! to invert the sense of the match. A match can be:

  1. Source or dest ip address
  2. Interface name
  3. Protocol name etc


The following will match all protocol except UDP:

iptables -A INPUT -p ! UDP

The following match allows IP address range matching and it can be inverted using the ! sign:

iptables -A INPUT -d -j DROP
iptables -A OUTPUT -d ! -J ACCEPT
# we trust so skip it
iptables -A OUTPUT -s ! -J DROP

The exclamation mark inverts the match so this will result is a match if the IP is anything except one in the given range

iptables -A INPUT -s ! -p tcp --dport 80 -J DROP

You can skip your own ip from string test:

iptables -A FORWARD -i eth0 -p tcp ! -s --sport 80 -m string --string '|7F|ELF' -j DROP

Accept port 22 traffic on all interfaces except for eth1 which is connected to the Internet:

iptables -A INPUT -i !eth1 -p tcp --dport 22  -j ACCEPT

Recommended readings:

man iptables

Tweet itFacebook itG+ itDownload PDF versionFound an error/typo on this page?

{ 4 comments… read them below or add one }

1 Zdenek Styblik January 29, 2010 at 8:04 pm

Recently, iptables changed syntax in favor of prefixing, so:
iptables -A INPUT ! -s; << correct
iptables -A INPUT -s !; << also correct, but iptables warns you this is a deprecated way to do. so it's question for how long is it going to work.
This prefixing applies for everything, not just source IP address.


2 nixCraft January 30, 2010 at 9:06 am


You may be right about syntax but most of our systems are running on RHEL 4/5 or CentOS 4/5 and it is not updated by Red Hat. I guess RHEL 6 will come with latest version.


3 Zdenek Styblik February 2, 2010 at 5:04 pm

Ok, sorry for the post then.


4 Bryan May 5, 2013 at 2:11 pm

Wouldn’t you know it? It’s now three years and some days later and now only the prefix ! version of syntax works (squid3). :-P


Leave a Comment

Tagged as: , , , , , , , ,

Previous Faq:

Next Faq: