Sstrhsrtj

The help information doesn't seem to be very informative:

--list    -L [chain [rulenum]]

      List the rules in a chain or all chains

--list-rules -S [chain [rulenum]]

      Print the rules in a chain or all chains

The only difference is in the choice of word: "list" vs. "print".

THe manual is a bit more detailed but still doesn't help:

   -L, --list [chain]

          List all rules in the selected chain.  If no chain is selected, all chains are listed. Like every other iptables command, it applies to the specified table (filter  is  the  default),  so  NAT

          rules get listed by

           iptables -t nat -n -L

          Please note that it is often used with the -n option, in order to avoid long reverse DNS lookups.  It is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atom‐

          ically listed and zeroed.  The exact output is affected by the other arguments given. The exact rules are suppressed until you use

           iptables -L -v



   -S, --list-rules [chain]

          Print all rules in the selected chain.  If no chain is selected, all chains are printed like iptables-save. Like every other iptables command, it applies to the specified table (filter is  the

          default).

Seems to me that -S is actually more detailed and printed out the exact ports that I allowed with a --dports argument. But why is that the case? I don't think the word "print" automatically suggests a higher level of details than "list"?

The difference is the output format. The -S option produces in the the fashion of iptables-save. And this can be reused with iptables-apply,iptables-restore. (Check their man pages entries for details.) So you can think of the difference as:

• 
  -L is for reference, to get a clue of what's there


• 
  -S is for reusable output, which is for machine parsing

If you think the -S option gives more details, then you should learn other iptables parameters that provide more details in combination with -L.