General question about chains

General question about chains

[Joey]

Hello All,

While I have used iptables for a while, I have found that I needed to gain
more knowledge to push what I am doing with it to another level.

I have read through a few things on-line and in the readme stuff, but have
some confusion that I want to clear up.

I am thinking that a chain is a group of rules, and I can create multiple
chains to define rules for different things.
Lets say FTP-RULES, SPAM-RULES etc.

If I do this I can hopefully flush just one group or chain without effecting
the other rules is what I am thinking.

When I execute a rule I do this:
iptables -A INPUT -p tcp -s 118.242.0.0/16 -j LOG --log-prefix SPAM-BLOCK-
CIDR-ASIAN
iptables -A INPUT -p tcp -s 118.242.0.0/16 --dport 25 -j DROP


I wanted to change it to add it to a chain like so:
iptables CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 -j LOG --log-prefix
SPAM-BLOCK-CIDR-ASIAN
iptables CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 --dport 25 -j DROP

iptables -N CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 -j LOG --log-prefix
SPAM-BLOCK-CIDR-ASIAN
iptables -N CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 --dport 25 -j DROP

This didn't work for me and I have tried several varients with no luck.

So my first question is do I understand correcty how to utilize chains?

Will I be able to load and unload chains rather than flush everything end
reload everything? ( I have a lot of rules )

Sample syntax would be great because I have found a million sites without
seeing what I really want.

Finally when I go to save these chains like the docs say
iptables-save -t fail2ban-VSFTPD I get the following error:
iptables-save v1.2.11: Can't initialize: Table does not exist (do you need
to
insmod?)

This happens on different versions of Centos & on a RH as well.

Thanks! ( sorry for the long description ).

Re: General question about chains

[Matt Zagrabelny]

[-- Attachment #1: Type: text/plain, Size: 2417 bytes --]

On Wed, 2008-10-15 at 23:46 -0400, Joey wrote:
> Hello All,
> 
> While I have used iptables for a while, I have found that I needed to gain
> more knowledge to push what I am doing with it to another level.
> 
> I have read through a few things on-line and in the readme stuff, but have
> some confusion that I want to clear up.
> 
> I am thinking that a chain is a group of rules, and I can create multiple
> chains to define rules for different things.
> Lets say FTP-RULES, SPAM-RULES etc.
> 
> If I do this I can hopefully flush just one group or chain without effecting
> the other rules is what I am thinking.
> 
> When I execute a rule I do this:
> iptables -A INPUT -p tcp -s 118.242.0.0/16 -j LOG --log-prefix SPAM-BLOCK-
> CIDR-ASIAN
> iptables -A INPUT -p tcp -s 118.242.0.0/16 --dport 25 -j DROP
> 
> 
> I wanted to change it to add it to a chain like so:
> iptables CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 -j LOG --log-prefix
> SPAM-BLOCK-CIDR-ASIAN
> iptables CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 --dport 25 -j DROP
> 
> iptables -N CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 -j LOG --log-prefix
> SPAM-BLOCK-CIDR-ASIAN
> iptables -N CIDR-ASIAN -A INPUT -p tcp -s 118.242.0.0/16 --dport 25 -j DROP

# create the chain
iptables -N CIDR-ASIAN

# hook the chain into another chain (PREROUTING, INPUT, FORWARD, etc)
iptables -A INPUT -j CIDR-ASIAN

# add rules to the new chain
iptables -A CIDR-ASIAN -p tcp -s 118.242.0.0/16 -j LOG --log-prefix
SPAM-BLOCK-CIDR-ASIAN

iptables -A CIDR-ASIAN -p tcp -s 118.242.0.0/16 --dport 25 -j DROP 

# flush the chain
iptable -F CIDR-ASIAN


> This didn't work for me and I have tried several varients with no luck.
> 
> So my first question is do I understand correcty how to utilize chains?
> 
> Will I be able to load and unload chains rather than flush everything end
> reload everything? ( I have a lot of rules )

I don't quite understand your question.

You 'create' and 'delete' user-defined chains. You can, of course, flush
chains individually as well.

-- 
Matt Zagrabelny - mzagrabe@d.umn.edu - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

RE: General question about chains

[Joey]

> -----Original Message-----
> From: Matt Zagrabelny [mailto:mzagrabe@d.umn.edu]
> Sent: Thursday, October 16, 2008 9:19 AM
> To: Joey
> Cc: netfilter@vger.kernel.org
> Subject: Re: General question about chains
> 
> # create the chain
> iptables -N CIDR-ASIAN
> 
> # hook the chain into another chain (PREROUTING, INPUT, FORWARD, etc)
iptables
> -A INPUT -j CIDR-ASIAN
> 
> # add rules to the new chain
> iptables -A CIDR-ASIAN -p tcp -s 118.242.0.0/16 -j LOG --log-prefix SPAM-
> BLOCK-CIDR-ASIAN
> 
> iptables -A CIDR-ASIAN -p tcp -s 118.242.0.0/16 --dport 25 -j DROP
> 
> # flush the chain
> iptable -F CIDR-ASIAN
> 
> 
> > This didn't work for me and I have tried several varients with no luck.
> >
> > So my first question is do I understand correcty how to utilize chains?
> >
> > Will I be able to load and unload chains rather than flush everything
> > end reload everything? ( I have a lot of rules )
> 
> I don't quite understand your question.
> 
> You 'create' and 'delete' user-defined chains. You can, of course, flush
> chains individually as well.


That's what I was looking for, however I have updated my script to create
the entries as shown, but seems like it's not working:
Do I have to tell iptables to activate a specific table of entries?
Here is a snip from iptables-save and basically NOTHING is being blocked.

Thanks!

# Generated by iptables-save v1.2.11 on Thu Oct 16 17:08:54 2008
*filter
:INPUT ACCEPT [129969:48753771]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [128669:50573226]
:CIDR-ASIAN - [0:0]
:CIDR-CZECH - [0:0]
:CIDR-IISG - [0:0]
:CIDR-INDIA-KOREA - [0:0]
:CIDR-POLAND - [0:0]
:CIDR-RUSSIA - [0:0]
:CIDR-TURKEY - [0:0]
:CIDR-UK - [0:0]
:TEST-JACK - [0:0]
:fail2ban-postfix - [0:0]
:fail2ban-postfix-log - [0:0]
-A CIDR-ASIAN -s 58.14.0.0/255.254.0.0 -p tcp -j LOG --log-prefix
"SPAM-BLOCK-CIDR-ASIAN" 
-A CIDR-ASIAN -s 58.14.0.0/255.254.0.0 -p tcp -m tcp --dport 25 -j DROP 
-A CIDR-ASIAN -s 58.16.0.0/255.248.0.0 -p tcp -j LOG --log-prefix
"SPAM-BLOCK-CIDR-ASIAN" 
-A CIDR-ASIAN -s 58.16.0.0/255.248.0.0 -p tcp -m tcp --dport 25 -j DROP 
-A CIDR-ASIAN -s 58.24.0.0/255.254.0.0 -p tcp -j LOG --log-prefix
"SPAM-BLOCK-CIDR-ASIAN" 
-A CIDR-ASIAN -s 58.24.0.0/255.254.0.0 -p tcp -m tcp --dport 25 -j DROP 
-A CIDR-ASIAN -s 58.29.0.0/255.255.0.0 -p tcp -j LOG --log-prefix
"SPAM-BLOCK-CIDR-ASIAN" 
-A CIDR-ASIAN -s 58.29.0.0/255.255.0.0 -p tcp -m tcp --dport 25 -j DROP

RE: General question about chains

[Покотиленко Костик]

В Чтв, 16/10/2008 в 18:16 -0400, Joey пишет:
> > -----Original Message-----
> > From: Matt Zagrabelny [mailto:mzagrabe@d.umn.edu]
> > Sent: Thursday, October 16, 2008 9:19 AM
> > To: Joey
> > Cc: netfilter@vger.kernel.org
> > Subject: Re: General question about chains
> > 
> > # create the chain
> > iptables -N CIDR-ASIAN
> > 
> > # hook the chain into another chain (PREROUTING, INPUT, FORWARD, etc)
> iptables
> > -A INPUT -j CIDR-ASIAN
> > 
> > # add rules to the new chain
> > iptables -A CIDR-ASIAN -p tcp -s 118.242.0.0/16 -j LOG --log-prefix SPAM-
> > BLOCK-CIDR-ASIAN
> > 
> > iptables -A CIDR-ASIAN -p tcp -s 118.242.0.0/16 --dport 25 -j DROP
> > 
> > # flush the chain
> > iptable -F CIDR-ASIAN
> > 
> > 
> > > This didn't work for me and I have tried several varients with no luck.
> > >
> > > So my first question is do I understand correcty how to utilize chains?
> > >
> > > Will I be able to load and unload chains rather than flush everything
> > > end reload everything? ( I have a lot of rules )
> > 
> > I don't quite understand your question.
> > 
> > You 'create' and 'delete' user-defined chains. You can, of course, flush
> > chains individually as well.
> 
> 
> That's what I was looking for, however I have updated my script to create
> the entries as shown, but seems like it's not working:
> Do I have to tell iptables to activate a specific table of entries?
> Here is a snip from iptables-save and basically NOTHING is being blocked.
> 
> Thanks!
> 
> # Generated by iptables-save v1.2.11 on Thu Oct 16 17:08:54 2008
> *filter
> :INPUT ACCEPT [129969:48753771]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [128669:50573226]
> :CIDR-ASIAN - [0:0]
> :CIDR-CZECH - [0:0]
> :CIDR-IISG - [0:0]
> :CIDR-INDIA-KOREA - [0:0]
> :CIDR-POLAND - [0:0]
> :CIDR-RUSSIA - [0:0]
> :CIDR-TURKEY - [0:0]
> :CIDR-UK - [0:0]
> :TEST-JACK - [0:0]
> :fail2ban-postfix - [0:0]
> :fail2ban-postfix-log - [0:0]
> -A CIDR-ASIAN -s 58.14.0.0/255.254.0.0 -p tcp -j LOG --log-prefix
> "SPAM-BLOCK-CIDR-ASIAN" 
> -A CIDR-ASIAN -s 58.14.0.0/255.254.0.0 -p tcp -m tcp --dport 25 -j DROP 
> -A CIDR-ASIAN -s 58.16.0.0/255.248.0.0 -p tcp -j LOG --log-prefix
> "SPAM-BLOCK-CIDR-ASIAN" 
> -A CIDR-ASIAN -s 58.16.0.0/255.248.0.0 -p tcp -m tcp --dport 25 -j DROP 
> -A CIDR-ASIAN -s 58.24.0.0/255.254.0.0 -p tcp -j LOG --log-prefix
> "SPAM-BLOCK-CIDR-ASIAN" 
> -A CIDR-ASIAN -s 58.24.0.0/255.254.0.0 -p tcp -m tcp --dport 25 -j DROP 
> -A CIDR-ASIAN -s 58.29.0.0/255.255.0.0 -p tcp -j LOG --log-prefix
> "SPAM-BLOCK-CIDR-ASIAN" 
> -A CIDR-ASIAN -s 58.29.0.0/255.255.0.0 -p tcp -m tcp --dport 25 -j DROP

Did you forgot COMMIT at the end? Entries are actually being add
all-in-one-time on COMMIT.

-- 
Покотиленко Костик <casper@meteor.dp.ua>

RE: General question about chains

[Gilad Benjamini]

> 
> So my first question is do I understand correcty how to utilize chains?
> 
> Will I be able to load and unload chains rather than flush everything
> end
> reload everything? ( I have a lot of rules )
> 
> Sample syntax would be great because I have found a million sites
> without
> seeing what I really want.
> 

If you are talking about iptables-restore, you should use the "--noflush"
flag.
It will initialize (and completely override) only those chains defined in
the input.
Note, though, that it should include all chains referenced as targets of
your rules within this input.