Why order matters more than any individual rule

iptables evaluates rules within a chain top to bottom and stops at the first match — a packet that matches an early ACCEPT rule never even reaches a later DROP rule intended to block it, and vice versa. That means a rule set can consist entirely of individually correct, sensible-looking rules and still do the wrong thing overall, purely because of the order they're listed in. This tool explains what each rule does in isolation, which is a necessary first step for understanding a rule set — but it deliberately doesn't try to detect one rule shadowing another, since that requires reasoning about the full ordered sequence together, not any single line.

Reading a rule as a sequence of AND conditions

Every flag on an iptables rule line narrows the match further — `-p tcp --dport 22 -s 10.0.0.0/8` means TCP protocol AND destination port 22 AND source in that /8 range, all three conditions required simultaneously for the rule to match and its `-j` target to apply. This is easy to misread quickly, especially with several flags and a `!` negation thrown in, which is exactly why rendering each rule as a full plain-English sentence — rather than just labeling the individual flags — matters: it forces the AND relationship between conditions to be spelled out explicitly rather than left for the reader to reconstruct.