Check for IP Block

Luke Hebert

- 2 minutes read - 292 words

If you suspect a client or server is being silently dropped by your firewall, the fastest way to confirm is to grep the live iptables rule set for that address. No need to scroll through hundreds of lines manually.

The Command

iptables -L -n --line | grep <ip>

Replace <ip> with the actual address you want to check, for example:

iptables -L -n --line | grep 192.168.1.50

What the Flags Do

  • -L lists all rules in the filter table.
  • -n prints addresses and ports in numeric form instead of resolving hostnames or service names, which keeps the output fast and unambiguous.
  • --line prepends a line number to each rule so you can reference a specific entry when you need to modify or delete it later.

Reading the Output

Each matching line will show the chain (typically INPUT, FORWARD, or OUTPUT), the line number, the target (such as DROP or REJECT), and the source/destination address. If the target is DROP, traffic from that IP is being silently discarded. If it is REJECT, the sender gets an ICMP unreachable message back.

No Match?

If the command returns nothing, the IP is not explicitly blocked by a filter-table rule. In that case, check the nat and mangle tables as well:

iptables -t nat -L -n --line | grep <ip>
iptables -t mangle -L -n --line | grep <ip>

You can also verify that the default policy for the relevant chain is not DROP:

iptables -L INPUT -n | head -1

Quick Tip

If you are managing rules through nftables instead of legacy iptables, the equivalent lookup is:

nft list ruleset | grep <ip>

This keeps your troubleshooting consistent whether the host is running the classic or the newer netfilter frontend.