From: Anders Fugmann <afu@fugmann.dhs.org>
To: Jeroen Wortelboer <jeroen@carotechnology.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: problems filtering ppp devices
Date: Mon, 09 Sep 2002 14:06:23 +0200 [thread overview]
Message-ID: <3D7C8EBF.8030000@fugmann.dhs.org> (raw)
In-Reply-To: 004d01c257e4$eceb7890$0401a8c0@titanium
Jeroen Wortelboer wrote:
> Hi there,
>
> I am encountering some weird stuff while filtering a ppp device.
> It seems like traffic from the ppp device does not enter the INPUT or
> OUTPUT table. Only when the destination of the traffic is another
> interface on the same machne does the INPUT or OUTPUT table see the
> traffic (i am logging all traffic through the ppp device. . .).
A packet traverses the INPUT chain (filter table), only if it is
destined for the firewall itself. All packets originating from the
firewall traverses the OUTPUT chain. The FORWARD chain is traversed by
packets that enters one interface and leaves another (forwarded by
linux). In all the obersevation is correct, and indeed intended.
> Filtering this fraffic on the forward of nat tables works fine, but
> leaves me with an unhappy feeling...
Filtering in the nat table?. Please use the filter table for filtering.
>
> I did some google-ing for this problem and came up empty. I hope I am
> doing something wrong here because otherwise this could be a serious
> problem.
I guess that you was not using the terms "iptables traversing tables".
It would have given you the link to the tutorial. See:
http://www.iptables.org/documentation/tutorials/blueflux/iptables-tutorial.html#TRAVERSINGOFTABLES
Hope it helps.
Regards
Anders Fugmann
--
Author of FIAIF
FIAIF Is An Intelligent/Iptables Firewall.
http://fiaif.fugmann.dhs.org
next prev parent reply other threads:[~2002-09-09 12:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-09-09 9:40 problems filtering ppp devices Jeroen Wortelboer
2002-09-09 12:06 ` Anders Fugmann [this message]
-- strict thread matches above, loose matches on Subject: below --
2002-09-09 10:40 Rob Sterenborg
2002-09-09 11:44 ` Jeroen Wortelboer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3D7C8EBF.8030000@fugmann.dhs.org \
--to=afu@fugmann.dhs.org \
--cc=jeroen@carotechnology.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.