# Iptables rules for tunneler

**URL:** <https://openziti.discourse.group/t/iptables-rules-for-tunneler/94>\
**Category:** Ziti Tunnel\
**Created:** [February 14, 2020, 4:27pm UTC](https://openziti.discourse.group/t/iptables-rules-for-tunneler/94 "2020-02-14T16:27:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dariuszSki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dariuszski/32/339_2.png) [@dariuszSki](https://openziti.discourse.group/u/dariuszSki)\
**Post date:** [February 14, 2020, 4:27pm UTC](https://openziti.discourse.group/t/iptables-rules-for-tunneler/94/1 "2020-02-14T16:27:22Z")

</div>

It looks like the tunneler still adds by default udp and tcp rules for the same port even though the service is configured as TCP. According to the source code, this is no longer hardcoded as it was v0.5 and it is passed as a variable. Am I reading this correctly?

```
...
interceptAddr, err := intercept.NewInterceptAddress(service, port.GetProtocol(), resolver)
...
"-p", interceptAddr.Proto(),
...

```

[tproxy\_linux.go](https://github.com/netfoundry/ziti-edge/blob/master/tunnel/intercept/tproxy/tproxy_linux.go#L300)

---

<div class="post-metadata">

**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\
**Post date:** [February 14, 2020, 4:46pm UTC](https://openziti.discourse.group/t/iptables-rules-for-tunneler/94/2 "2020-02-14T16:46:55Z")

</div>

The UDP intercept is still hard-coded. It was moved upwards in the call stack (to [tproxy\_linux.go#L292](https://github.com/netfoundry/ziti-edge/blob/master/tunnel/intercept/tproxy/tproxy_linux.go#L292) when intercept cleanup was fixed ([ziti-edge#24](https://github.com/netfoundry/ziti-edge/pull/24))