lkml.org 
[lkml]   [2002]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subjectorder of ip tables/chains?
Date
Dunno if this mail and your replies will reach the list/me,
we have some DNS problems here...

I'm setting up a firewall. I want to understand precise order
in which a packet traverse a multitude of ip tables/chains
which exist in recent 2.4 (say 2.4.20). This is what I currently
placed at the top of my script:

### filter This is the default table (if no -t option is passed). It contains
### the built-in chains INPUT (for packets coming into the box itself),
### FORWARD (for packets being routed through the box), and OUTPUT (for
### locally-generated packets).
###
### nat This table is consulted when a packet that creates a new connection
### is encountered. It consists of three built-ins: PREROUTING (for
### altering packets as soon as they come in), OUTPUT (for altering
### locally-generated packets before routing), and POSTROUTING (for
### altering packets as they are about to go out).
###
### mangle This table is used for specialized packet alteration. Until kernel
### 2.4.17 it had two built-in chains: PREROUTING (for altering incoming
### packets before routing) and OUTPUT (for altering locally-generated
### packets before routing). Since kernel 2.4.18, three other built-in
### chains are also supported: INPUT (for packets coming into the box
### itself), FORWARD (for altering packets being routed through the
### box), and POSTROUTING (for altering packets as they are about to go
### out).

(above: taken directly from man iptables)
(below: this is how I understand it. Combined from Rusty's excellent docs
on NAT and filtering. Thanks Rusty! Anyone spot something wrong below?)

###
###
### ..iface....................................iface...
### | ^
### v |
### -NAT,mangle- -filter,mangle- -NAT,mangle--
### |PREROUTING|->[Routing ]-->|FORWARD |-->|POSTROUTING|
### ------------ [Decision] --------------- -------------
### | ^
### v |
### -filter,mangle- -filter,NAT,mangle-
### |INPUT | |OUTPUT |
### --------------- -------------------
### | ^
### v |
### ... Local Process...
### ....Local Process...

(below: basically this is what I ask)

### TODO: check order of each a,b
### check whether is OUTPUT drawn where it should be
### (or maybe different table's OUTPUTs must be in different places?)
--
vda
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:31    [W:0.028 / U:1.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site