title: IPTables Rules Order
body: <p>I am trying to implement IPTables rules for traffic on port 443. I want to allow NEW connections up until they reach a rate limit, then drop them and log the dropped packets (I'll add rate limiting to the logging later). However, with the rules I have, my logging rule gets called with every NEW connection. I don't want to make a log entry unless the rate limit has already been reached.</p>
  
  <p>Regardless of the amount of google searching I do, I can't seem to figure out this extremely basic question. I <em>believe</em> I understand that an ACCEPT rule will stop any subsequent rules from being called. But placing my logging rule either before or after the ACCEPT rule does not make any difference - the connection is still logged.</p>
  
  <p>iptables -L -v -n is as follows for the INPUT chain:</p>
  
  <pre><code>Chain INPUT (policy DROP 2 packets, 88 bytes)  pkts bytes target     prot opt in     out     source               destination         
      0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 state NEW limit: avg 50/min burst 10
      0     0 LOG        tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 state NEW LOG flags 7 level 7 prefix "IPTables-50/m-Dropped: "
      9   612 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  </code></pre>