How to add comments to iptables rules

Rule comments make runtime iptables policies easier to audit after a change window. A packet still matches only the protocol, address, port, interface, state, and target fields, but a short comment keeps the reason for a rule visible when another administrator lists the chain later.

The comment match adds text with --comment and stores it beside the rule. Current iptables output shows that text as a C-style comment in verbose list output and as -m comment –comment in command-form output.

Use comments for change tickets, service names, owners, or review labels that will still make sense after reboot. Do not use comments as the only access-control boundary, and keep the text short enough to read in a normal chain listing.

1. List the target chain before adding the commented rule.

   $ sudo iptables --list INPUT --line-numbers --numeric --verbose
   Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
   num   pkts bytes target     prot opt in     out     source               destination

   Use the chain that actually sees the packet path. Local inbound service rules usually belong in INPUT, routed gateway rules in FORWARD, and locally generated outbound rules in OUTPUT.
   Related: How to list iptables rules with counters

2. Add the rule with the comment match.

   $ sudo iptables -A INPUT -p tcp --dport 443 -m comment --comment allow-https-from-load-balancer -j ACCEPT

   The example permits TCP port 443 and labels the reason. Use a ticket, owner, or service name that can be reviewed later without exposing sensitive internal detail.

3. Check that the exact commented rule exists.

   $ sudo iptables -C INPUT -p tcp --dport 443 -m comment --comment allow-https-from-load-balancer -j ACCEPT

   No output means the exact rule specification is present. A nonzero exit means the chain does not contain the same rule and comment text.

4. Print the command-form rule to verify the stored comment.

   $ sudo iptables -S INPUT
   -P INPUT ACCEPT
   -A INPUT -p tcp -m tcp --dport 443 -m comment --comment allow-https-from-load-balancer -j ACCEPT

5. List the chain with counters to confirm the comment is visible during audits.

   $ sudo iptables --list INPUT --line-numbers --numeric --verbose
   Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
   num   pkts bytes target     prot opt in     out     source               destination
   1        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 /* allow-https-from-load-balancer */

6. Test the allowed service from the expected client path.

   $ nc -vz -w 2 server.example.com 443
   Connection to server.example.com 443 port [tcp/https] succeeded!

   The comment proves audit context, not packet behavior. A client test and the rule counter prove the rule matched useful traffic.

7. Remove or replace the rule by exact match when the comment is wrong.

   $ sudo iptables -D INPUT -p tcp --dport 443 -m comment --comment allow-https-from-load-balancer -j ACCEPT

   Deleting by exact match avoids relying on a line number that may change after other rule edits.
   Related: How to delete an iptables rule

8. Save the runtime rule after the service test and comment review pass.

   $ sudo netfilter-persistent save
   run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save

   Do not persist a rule whose match is wrong just because the comment is useful. Correct the rule first, then save the verified runtime policy.
   Related: How to save iptables rules permanently