Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Track down those silent network drops before you lose your mind

🧩 The Challenge

You know that feeling when you’re 100% sure your firewall rules are correct, but the packets still aren’t hitting your app? I’ve wasted entire afternoons hunting through iptables rules only to realize the traffic never made it past the input chain.

💡 The Fix

Stop guessing and start watching the drop counters live with a simple trace command that shows exactly which rule is killing your connection. It saves you from reading thousands of lines of rules by hand.

iptables -t raw -I PREROUTING -p tcp --dport 8080 -j TRACE
ip6tables -t raw -I PREROUTING -p tcp --dport 8080 -j TRACE
tail -f /var/log/kern.log | grep TRACE

⚙️ Why It Works

This works by inserting a trace flag into the raw table, which forces the kernel to log every single rule the packet hits as it travels through the stack. Once you spot the log line, you’ll see the exact chain and rule number causing the drop.

🚀 Pro-Tip: Don’t forget to delete these rules once you’re done, or you’ll accidentally flood your logs with debugging info until the disk hits 100%.

Linux Tips & Tricks | © ngelinux.com | 7/16/2026