Command by command
| Cisco IOS | Linux | What it gives you |
|---|---|---|
show access-lists | iptables -L -n -v --line-numbers | All rules with hit counters |
show ip access-lists 101 | iptables -L FORWARD -n -v | Rules on the forwarding path |
show ip interface ge0 | include access list | iptables -L FORWARD -n -v | grep ge0 | Rules referencing an interface |
clear access-list counters | iptables -Z | Zero the counters |
| iptables -t nat -L -n -v | NAT rules live in a separate table |
What the output looks like
$ iptables -L FORWARD -n -v --line-numbers
Chain FORWARD (policy DROP 12 packets, 1008 bytes)
num pkts bytes target prot opt in out source destination
1 140 11760 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
2 18 1512 ACCEPT 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
3 6 504 DROP 6 -- * * 10.0.1.0/24 10.0.3.50 tcp dpt:22
4 9 756 ACCEPT 1 -- * * 0.0.0.0/0 0.0.0.0/0Why the two differ
Two differences matter. First, an ACL is bound to an interface and a direction, and a packet is only evaluated against ACLs on the interfaces it traverses. Netfilter instead evaluates chains by role: INPUT for traffic to this host, OUTPUT from it, and FORWARD for traffic passing through — with interface matching as an optional -i/-o condition rather than the organising principle. Second, IOS ACLs are stateless unless you configure reflexive ACLs or a zone-based firewall; netfilter has connection tracking available on every rule via ctstate, which is why the first rule in almost every real rule set accepts ESTABLISHED,RELATED.
The trap
The chain's default policy is printed in the header line, not as a rule, and it is easy to miss. policy DROP means anything not explicitly accepted is dropped — the implicit deny — while policy ACCEPT means the opposite and turns a rule list that looks restrictive into one that permits everything it does not name. Read the policy before reading the rules. And with -n, iptables 1.8.9 prints the protocol as a number (6 is TCP, 1 ICMP, 0 any), while without it you get names and anywhere.
Common questions
Should I be using nftables instead?
On new systems, yes — nftables is the successor and nft list ruleset is its equivalent command. Most distributions still ship an iptables binary that is a compatibility wrapper writing nftables rules underneath, so the older syntax keeps working and remains what most documentation uses.
Why does my rule never match?
Check the chain first. A rule placed in INPUT will never see traffic that is being routed through the host — that is FORWARD. The per-rule packet counter from -v tells you immediately whether a rule is being evaluated at all.
Stop reading, start running
Open the lab, go live, and run iptables -L -n -v against real Linux networking in your browser. No install, no signup.