iptables -p all --dport
--dport is not a flag for general iptables rules. It's a flag for one of it's extended packet matching modules. These are loaded when you use -p protocol
or -m
. Unless you specify -m <protocol>
or -p <protocol>
with a specific protocol you can't use --dport
You'll see this within the iptables(8) or iptables-extensions(8) manual page:
tcp
These extensions can be used if `--protocol tcp' is specified. It provides the
following options:
...
[!] --destination-port,--dport port[:port]
Destination port or port range specification. The flag --dport is a
convenient alias for this option.
...
Not all protocols have a --dport flag because not all protocols support the notion of ports
'all' encompasses more than just TCP and UDP; it also covers protocols like ICMP which have no concept of port numbers, and thus can't take a --dport parameter.