-i and -o options for iptables FORWARD chain

-i and -o options for iptables FORWARD chain

[Gongya Yu]

[-- Attachment #1: Type: text/plain, Size: 271 bytes --]

Hi, I just updated Linux kernel to 2.6.0 with iptables and ebtables enabled.

But iptables ignores -i and -o options for FORWARD chain. Wheneneve I use something like -i eth0 or -o eth0, the rule is just ignored.

Any suggestions ?

thanks in advance!!

Gongya Yu

[-- Attachment #2: Type: text/html, Size: 950 bytes --]

Re: -i and -o options for iptables FORWARD chain

[Antony Stone]

On Wednesday 31 December 2003 11:36 pm, Gongya Yu wrote:

> Hi, I just updated Linux kernel to 2.6.0 with iptables and ebtables
> enabled.
>
> But iptables ignores -i and -o options for FORWARD chain. Wheneneve I use
> something like -i eth0 or -o eth0, the rule is just ignored.
>
> Any suggestions ?

I am not a 2.6 expert by any means, so this is just a suggestion: did you 
recompile the userspace tools (iptables) to match the new kernel code 
(netfilter)?

Antony.

-- 
My New Year's resolution is not to make any resolutions I can't keep.

I'm wondering whether I've failed already.
                                                     Please reply to the list;
                                                           please don't CC me.

Re: [despammed] -i and -o options for iptables FORWARD chain

[Andreas Kretschmer]

am  Wed, dem 31.12.2003, um 15:36:34 -0800 mailte Gongya Yu folgendes:
> Hi, I just updated Linux kernel to 2.6.0 with iptables and ebtables enabled.

I'm using iptables on 2.4.x, possible there are differences with 2.6.x.

>  
> But iptables ignores -i and -o options for FORWARD chain. Wheneneve I use
> something like -i eth0 or -o eth0, the rule is just ignored.

RTFM!

-i is only for INPUT, FORWARD and PREROUTING
-o is only for FORWARD, OUTPUT and POSTROUTING

You can use -s and -d (Source and Destination-IP).


Andreas
-- 
Diese Message wurde erstellt mit freundlicher Unterstützung eines freilau-
fenden Pinguins aus artgerechter Freilandhaltung.   Er ist garantiert frei
von Micro$oft'schen Viren. (#97922 http://counter.li.org)     GPG 7F4584DA
Was, Sie wissen nicht, wo Kaufbach ist? Hier: N 51.05082°, E 13.56889° ;-)

Re: [despammed] -i and -o options for iptables FORWARD chain

[Antony Stone]

On Friday 02 January 2004 1:30 pm, Andreas Kretschmer wrote:

> am  Wed, dem 31.12.2003, um 15:36:34 -0800 mailte Gongya Yu folgendes:
> > Hi, I just updated Linux kernel to 2.6.0 with iptables and ebtables
> > enabled.
>
> I'm using iptables on 2.4.x, possible there are differences with 2.6.x.
>
> > But iptables ignores -i and -o options for FORWARD chain. Wheneneve I use
> > something like -i eth0 or -o eth0, the rule is just ignored.
>
> RTFM!
>
> -i is only for INPUT, FORWARD and PREROUTING
> -o is only for FORWARD, OUTPUT and POSTROUTING

Are you suggesting that -i and -o cannot be used in FORWARD?   As far as I can 
see the syntax of the rule Gonya posted is perfectly okay.

Antony.

-- 
Christmas is an opportunity to upgrade to kernel 2.6 while no-one's around to 
notice the downtime.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: [despammed] -i and -o options for iptables FORWARD chain

[Andreas Kretschmer]

am  Fri, dem 02.01.2004, um 14:03:02 +0000 mailte Antony Stone folgendes:
> > -i is only for INPUT, FORWARD and PREROUTING
> > -o is only for FORWARD, OUTPUT and POSTROUTING
> 
> Are you suggesting that -i and -o cannot be used in FORWARD?   As far as I can 
> see the syntax of the rule Gonya posted is perfectly okay.

Oh, i'm sorry, parse error by me =:-(


Andreas
-- 
Diese Message wurde erstellt mit freundlicher Unterstützung eines freilau-
fenden Pinguins aus artgerechter Freilandhaltung.   Er ist garantiert frei
von Micro$oft'schen Viren. (#97922 http://counter.li.org)     GPG 7F4584DA
Was, Sie wissen nicht, wo Kaufbach ist? Hier: N 51.05082°, E 13.56889° ;-)

RE: [despammed] -i and -o options for iptables FORWARD chain

[bmcdowell]

Actually, couldn't this be just a 2.6.x change? (I never saw the rules go by...)  I thought I saw a message go by earlier to that effect.  Something about the syntax and needing '--physdev' and '-i' both, or something?

I could search the archives, I guess, but instead I suggest Gonya give that a go.


Bob
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone
Sent: Friday, January 02, 2004 8:03 AM
To: netfilter@lists.netfilter.org
Subject: Re: [despammed] -i and -o options for iptables FORWARD chain


On Friday 02 January 2004 1:30 pm, Andreas Kretschmer wrote:

> am  Wed, dem 31.12.2003, um 15:36:34 -0800 mailte Gongya Yu folgendes:
> > Hi, I just updated Linux kernel to 2.6.0 with iptables and ebtables
> > enabled.
>
> I'm using iptables on 2.4.x, possible there are differences with 2.6.x.
>
> > But iptables ignores -i and -o options for FORWARD chain. Wheneneve I use
> > something like -i eth0 or -o eth0, the rule is just ignored.
>
> RTFM!
>
> -i is only for INPUT, FORWARD and PREROUTING
> -o is only for FORWARD, OUTPUT and POSTROUTING

Are you suggesting that -i and -o cannot be used in FORWARD?   As far as I can 
see the syntax of the rule Gonya posted is perfectly okay.

Antony.

-- 
Christmas is an opportunity to upgrade to kernel 2.6 while no-one's around to 
notice the downtime.

                                                     Please reply to the list;
                                                           please don't CC me.

RE: [despammed] -i and -o options for iptables FORWARD chain

[Andy Loukes]

On Fri, 2 Jan 2004 bmcdowell@coxhealthplans.com wrote:

> Actually, couldn't this be just a 2.6.x change? (I never saw the rules
> go by...)  I thought I saw a message go by earlier to that effect.  
> Something about the syntax and needing '--physdev' and '-i' both, or
> something?
> 
> I could search the archives, I guess, but instead I suggest Gonya give
> that a go.

No, the physdev stuff is for bridging. -i and -o work the same in 2.6 as 
2.4

-- 
Andy Loukes
http://www.navaho.co.uk				Complete Appliance Technology

Re: [despammed] -i and -o options for iptables FORWARD chain

[Unknown, Alistair Tonner]

On January 2, 2004 10:13 am, bmcdowell@coxhealthplans.com wrote:
> Actually, couldn't this be just a 2.6.x change? (I never saw the rules go
> by...)  I thought I saw a message go by earlier to that effect.  Something
> about the syntax and needing '--physdev' and '-i' both, or something?
>
> I could search the archives, I guess, but instead I suggest Gonya give that
> a go.
>



	Userspace tools need to be recompiled from 2.4.x kenels to 2.6.0 
	I got weird results switching.  Recompile fixed the problems.

	Alistair

>
> Bob
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone
> Sent: Friday, January 02, 2004 8:03 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: [despammed] -i and -o options for iptables FORWARD chain
>
> On Friday 02 January 2004 1:30 pm, Andreas Kretschmer wrote:
> > am  Wed, dem 31.12.2003, um 15:36:34 -0800 mailte Gongya Yu folgendes:
> > > Hi, I just updated Linux kernel to 2.6.0 with iptables and ebtables
> > > enabled.
> >
> > I'm using iptables on 2.4.x, possible there are differences with 2.6.x.
> >
> > > But iptables ignores -i and -o options for FORWARD chain. Wheneneve I
> > > use something like -i eth0 or -o eth0, the rule is just ignored.
> >
> > RTFM!
> >
> > -i is only for INPUT, FORWARD and PREROUTING
> > -o is only for FORWARD, OUTPUT and POSTROUTING
>
> Are you suggesting that -i and -o cannot be used in FORWARD?   As far as I
> can see the syntax of the rule Gonya posted is perfectly okay.
>
> Antony.