Re: Let me understand *RETURN*

[Jason Opperisano <opie@817west.com>]

On Fri, Feb 18, 2005 at 11:15:58AM -0500, Mohammad Khan wrote:
> I have couple of chains and rules for filter table
> 
> -N TCP_IN
> -N TCP_OUT
> -N UDP_IN
> -N UDP_OUT
> -N ICMP_IN
> -N ICMP_OUT
> 
> -N P1_IN
> -N P1_OUT
> -N P2_IN
> -N P2_OUT
> 
> -A FORWARD -d IP_OF_P1 -j P1_IN
> -A FORWARD -s IP_OF_P1 -j P1_OUT
> 
> -A FORWARD -d IP_OF_P1 -j P1_IN
> -A FORWARD -s IP_OF_P1 -j P1_OUT

why do you have the above 2 rules twice?

> -A FORWARD -j LOG --log-prefix "NOT_FORWARDED "
> -A FORWARD -j DROP
> 
> -A P1_IN -t TCP -j TCP_IN
> -A P1_IN -t UDP -j UDP_IN
> -A P1_IN -t ICMP -j ICMP_IN
> -A P1_IN -j RETURN
> 
> -A TCP_IN -t TCP --dport 80 -J ACCPET
> -A TCP_IN -j RETURN

the option to specify the protocol is "-p" not "-t" (that specifies the
table to operate on)

> For any tcp packet that going to P1 and don't have destination port 80: 
> 
> returned to P1_IN chain from TCP_IN chain, then after
> returned to FORWARD chain from P1_IN, and finally
> dropping the packet after kept log.
> 
> Am I right?

yes, assuming the IP P1 is not local to the gateway in question.

-j

--
"When a woman says nothing's wrong, everything's wrong. When a woman
 says everything's wrong, *everything's* wrong. And when a woman says
 something's not funny, you'd better not laugh your ass off!"
        --The Simpsons