Repository navigation
New linter smell multiport-one-option (error). One -m multiport match takes one port list — --dports, --sports or --ports. A second one in the same match is refused (multiport: option "--source-ports" cannot be used together with "--destination-ports"), and the table loads nothing: its DROP policies never apply.
The trap is the singular: after -m multiport, --sport / --dport are read as abbreviations of multiport's --sports / --dports, so the classic client line -p tcp -m multiport --dports 80,443 --sport 1024:65535 is refused. Options bind to whichever loaded match knows them, not by position — a -m comment in between changes nothing, while an exact name in a loaded tcp/udp match (-m tcp, or an earlier --syn) wins.
Measured with iptables-restore on 34 variants (iptables 1.8.11, nf_tables and legacy agree on all); the detector replays the option binding and agrees with the kernel on all 34. New sample iptables (--dports + --sport in one multiport — won't load). 73 smells, tests 377.