Updated: 3 November 2026 · Applies to: iptables (iptables-nft backend) and ufw
To add a comment to an iptables rule, append -m comment --comment "your text" to the rule itself. iptables stores the comment with the rule, so it shows up later when you list the rules, which makes a firewall full of similar looking rules much easier to read months after you wrote it.
On current distributions, the iptables command itself is a compatibility layer in front of nftables (iptables-nft), so these commands still work exactly as shown even though the kernel is no longer using the older, separate iptables subsystem underneath.
Basic syntax
iptables -A INPUT -i eth0 -m comment --comment "allow LAN traffic" -j ACCEPT
A comment can be up to 256 characters.
Add a comment while blocking an IP
iptables -A INPUT -s 203.0.113.50 -j DROP -m comment --comment "block known abusive IP"
Add a comment while blocking a port
iptables -A INPUT -p tcp --dport 80 -m comment --comment "block HTTP" -j DROP
Where the comment shows up
List the rules in a chain or table to see the comments attached to each one:
iptables -L INPUT -n -v
Or for a specific table:
iptables -t nat -L -n -v
Add a comment to a rule that already exists
You cannot edit a rule's comment in place; replace the whole rule instead, using its chain and line number. First find the line number:
iptables -L INPUT -n --line-numbers
Then replace that exact rule, including the new comment:
iptables -R INPUT 5 -p tcp --dport 25 -j DROP -m comment --comment "block SMTP"
Comments in ufw
ufw (Uncomplicated Firewall), the simpler front end for iptables used on Ubuntu, Debian and several other distributions, supports comments too:
ufw allow 53 comment 'DNS'
Or add one to a rule you already wrote:
ufw rule comment 'allow SSH from the office'
Comments in a saved rules file
If you manage rules by editing a saved rules file directly, for example /etc/iptables/rules.v4, the same -m comment --comment "text" syntax works inline in the file. After changing it, reload the rules and confirm the comment is there:
iptables-restore < /etc/iptables/rules.v4 iptables -L -n -v
