Updated: 3 November 2026 · Applies to: iptables (iptables-nft backend)
To add an iptables rule at the top of a chain instead of the end, use -I (insert) instead of -A (append). Rules in a chain are checked in order, top to bottom, and the first match wins, so where a new rule lands in that order decides whether it actually takes effect before an existing rule already matches the same traffic.
List the current rules with their line numbers
Before adding anything, see what order the existing rules are in:
iptables -L INPUT -n --line-numbers
The same works for any chain or table:
iptables -L OUTPUT -n --line-numbers iptables -t nat -L -n --line-numbers
Append: add a rule to the end of a chain
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
Since the default policy and any earlier, broader rule are checked first, an appended rule only matters for traffic that was not already matched by something above it.
Insert: add a rule to the top of a chain
With no rule number given, -I inserts at position 1, the very top, so this rule is checked before every other rule already in the chain:
iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
Insert at a specific position instead of the very top
Give -I a rule number to insert there instead, pushing everything from that position downward:
iptables -I INPUT 3 -p tcp --dport 8080 -j ACCEPT
Why this matters for a DROP rule
This is most important when you add a rule that blocks something. If a broad ACCEPT rule already sits above where you append a new DROP rule, the traffic matches the ACCEPT first and your DROP rule never runs. Inserting the DROP rule above it fixes that:
iptables -I INPUT -s 203.0.113.50 -j DROP
Verify the final order:
iptables -L INPUT -n --line-numbers
