I'm using IPtables and I have a doubt that I can't find. I want to apply a rule in the PREROUTING of the nat table. The rule is supposed to execute a chain but I want it to be executed for every interfaces except for two of them. I can't use wildcards because I need all of the other interfaces regardless their name (say I can't have it).I have applied this rule:iptables -t nat -A PREROUTING -j my_chain ! -i eth0That results into this:Chain PREROUTING (policy ACCEPT 19 packets, 3008 bytes)pkts bytes target     prot opt in     out     source       destination10   1538  my_chain   all  -- !eth0   *       0.0.0.0/0    0.0.0.0/0But I need something like this:Chain PREROUTING (policy ACCEPT 19 packets, 3008 bytes)pkts bytes target     prot opt in               out     source      destination10   1538  my_chain   all  -- !(eth0 or tun0)   *       0.0.0.0/0   0.0.0.0/0The thing is it can not be in two different rules because one of this two interfaces will enter into the other's interface rule. I also tried something like:iptables -t nat -A PREROUTING -j my_chain ! -i eth0 ! -i tun0But it returns: multiple -i flags not allowedBassically I need a way to implement that or in the interface condition or !eth0 and !tun0 (logical equivalent).I'm using debian with iptables v1.4.21.Thanks for your help!
IPTables rule for neither of two interfaces
iptables;network interface
To solve your problem, you must remember that iptables rules are applied sequentially (as soon as one is found that applies, the packet is removed from the chain and the following rules in the same chain are just skipped), and that you may invent new chains; so let us define two new chains,  iptables -N chain1 iptables -N chain2and now we send packets on tun0 and eth0 to chain1, and everything else to chain2: iptables -t nat -A PREROUTING -i tun0 -j chain1 iptables -t nat -A PREROUTING -i eth0 -j chain1 iptables -t nat -A PREROUTING -j chain2 and now you can assign your rules separately to the two chains: for instance, to delete everything on chain2 but not on chain1,iptables -A chain1 -j ACCEPTiptables -A chain2 -j DROPThis trick allows you to build a rule equivalent to a boolean OR: if the packet is coming in thru eth0 OR thru tun0, then do... Since boolean AND is easy to implement (for instance, if something comes in thru eth0 and is destined to 8.8.8.8, then.. is equivalent to iptables -t nat -A PREROUTING -i eth0 -d 8.8.8.8 ....), you have both OR and AND connectives, which will allow you to build any truth table in the Boolean logic. 