Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop assuming your firewall rules are firing in order

🧩 The Challenge

Everyone thinks they’ve written a solid iptables rule until the connection stays dead and you realize a previous drop rule is stealing all your traffic. It is honestly maddening to stare at a config for an hour only to realize the packet hit the wrong chain index.

💡 The Fix

Start using the counter flag when you list your rules so you can actually watch which rules are catching packets in real-time. It’s the fastest way to see if your traffic is hitting a rule you thought was dead or getting swallowed by a hidden catch-all.

iptables -L -n -v --line-numbers

⚙️ Why It Works

Adding the -v flag forces the system to show packet and byte counters for every single rule. Seeing the counter increment right in front of your eyes as you try to curl the endpoint tells you exactly where your traffic is dying.

🚀 Pro-Tip: Pipe it into watch to turn it into a live packet-hitting-the-rule scoreboard.

Linux Tips & Tricks | © ngelinux.com | 9/16/2026