nion's blog

Iptables is strange. Today I made a mistake by adding an IP two times to a DROP chain.

Example:

$ iptables -I FOO -s 192.168.0.7 -j DROP
$ iptables -I FOO -s 192.168.0.7 -j DROP
$ iptables -L
target prot opt source destination
DROP all -- 192.168.0.7 anywhere
DROP all -- 192.168.0.7 anywhere

This is strange, seems like iptables is not checking double entries.
I also noticed that iptables -L will become very slow with double information.

What made me really perplex is:
$ iptables -D FOO -s 192.168.0.7 -j DROP
$ iptables -L
target prot opt source destination
DROP all -- 192.168.0.7 anywhere

So iptables deleted one of the IPs in comparison to my expectation that this will delete both entries.
Bug or Feature?