Introduction: The iptables and ip6tables commands are used to set up, maintain, and firewall rules on the Linux. You can define various tables. Each table contains a number of built-in chains moreover, may also contain user-defined chains. You can add comments to iptables. They can be instrumental in understanding firewall rules. This page shows how to add comments to iptables rules.

How to add comments to iptables rules on Linux

The syntax is as follows:
iptables -m comment --comment "comment here"
iptables -A INPUT -i eth1 -m comment --comment "my LAN - " -j DROP

Where are my comments displayed?

The iptables comment appears when you try to list iptables rules using the following syntax:
iptables -L
iptables -t filter -L FORWARD
iptables -t nat -L
iptables -t nat -L -n -v | more
iptables -t nat -L PREROUTING
iptables -t nat -L PREROUTING -n -v --line-number

Adding comments to iptables rules

Let us drop or block an IP address of spammer using iptables and add comment too:
# iptables -A INPUT -s -j DROP -m comment --comment "DROP spam IP address - "
Also block port 80 and 443 (HTTP/HTTPS) along with comment:
# iptables -A INPUT -p tcp --dport 80 -m comment --comment "block HTTPD access - " -j DROP
# iptables -A INPUT -p tcp --dport 443 -m comment --comment "block HTTPDS access - " -j DROP

Verify it:
# iptables -t filter -L INPUT -n

Create comments with iptables firewall for NAT rules

Here I am directly editing iptables config file /etc/sysconfig/iptables on a CentOS and adding rules:

-A PREROUTING -d -p tcp --dport 1:65535 -j DNAT --to-destination -m comment --comment "KVM hos to rhel7-nixcraft VM port forwarding"

You must reload the firewall. Verify it:
$ sudo iptables -t nat -L -n -v

Adding comments to ufw firewall rules

UFW is an acronym for uncomplicated firewall. It is used for managing a Linux firewall and aims to provide an easy to use interface for the user. It works on Ubuntu, Debian, Fedora, CentOS, Arch Linux and many other Linux distros. To add a comment for the ufw rule:
$ sudo ufw rule comment 'my comment here'
Open port 53 and write a comment about rule too:
$ sudo ufw allow 53 comment 'open tcp and udp port 53 for dns'
Another example:
$ sudo ufw allow proto tcp from any to any port 80,443 comment 'Open web app ports'


You just added comments to iptables rules. It is beneficial for maintaining rules in the long run for sure. 

Leave a Reply

Your email address will not be published. Required fields are marked *