You should first consult the command's manual page if you do not understand why/how it works. From man iptables
:
[!] -p, --protocol protocol
The protocol of the rule or of the packet
to check. The specified protocol can be one of tcp, udp, udplite,
icmp, esp, ah, sctp or the special keyword "all", or it can be a
numeric value, representing one of these protocols or a different one.
A protocol name from /etc/protocols is also allowed. A "!" argument
before the protocol inverts the test. The number zero is equivalent
to all. "all" will match with all protocols and is taken as default
when this option is omitted.
[!] -s, --source address[/mask][,...]
Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the sense of the address. The flag --src is an alias for this option. Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).
-j, --jump target
This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain
(other than the one this rule is in), one of the special builtin
targets which decide the fate of the packet immediately, or an
extension (see EXTENSIONS below). If this option is omitted in a rule
(and -g is not used), then matching the rule will have no effect on
the packet's fate, but the counters on the rule will be incremented.
[!] -i, --in-interface name
Name of an interface via which a packet
was received (only for packets entering the INPUT, FORWARD and
PREROUTING chains). When the "!" argument is used before the
interface name, the sense is inverted. If the interface name ends in
a "+", then any interface which begins with this name will match. If
this option is omitted, any interface name will match.
tcp
These extensions can be used if `--protocol tcp' is specified. It
provides the following options:
[..]
[!] --destination-port,--dport port[:port]
Destination port or port range specification. The flag --dport is a convenient alias for this option. [..]
Therefore, the iptables command you are asking about reads: 'drop (-j DROP
) TCP packets (-p tcp
) from IP addresses 192.168.1.0-192.168.1.255 (-s 192.168.1.0/24
) that are directed at port 80 (--dport 80
) on this host (-A INPUT
) and coming in on interface eth1 (-i eth1
).'
Note that if the -t
flag is not specified, -t filter
is implied (this is also mentioned in the manual).
Update (based on comment from OP):
The above iptables
line does not have anything to do with packets coming from IP address 1.2.3.4, and should probably be left out if the server/router does not have to block packets originating from the 192.168.1.0/24 subnet.
"I dont understand why this line :"
You don't understand why this line what? Why it works? Why it doesn't work? What it does? What do you expect it should do?