Re: mangle tables.

[Anders Fugmann <afu@fugmann.dhs.org>]

Hi Antony

Many thanks for your reply.
I see that I understand most of it.

Antony Stone wrote:
> On Tuesday 10 September 2002 7:49 am, Anders Fugmann wrote:
> 
>>Next, if the above is correct, when does packets hit the chains,
>>e.g. what chains are traversed between PREROUTING and FORWARD and
>>POSTROUTING, in the forwarding example?
> 
> 
> I don't know the answer to this for the latest version of netfilter, however 
> it is very easy to find out for yourself, for the specific version you are 
> running (which is usually the important thing).
Is this true - can someone please confirm this. It seems strange that 
only the order of chain traversal is specified within a table, but not 
across tables (If I understand you correctly, Antony).
This means, for example, that the mark cannot be used to to mark packets 
for later processing. (Mark in mangle and match in filter).

> 
> Simply set up a series of LOGging rules in the different chains & tables, 
> send some packets through the system, and the log file will tell you what 
> order the packets went through the different parts of netfilter.
> 
> Try this:
> 
> for chain in INPUT OUTPUT FORWARD PREROUTING POSTROUTING
> do
>   for table in filter mangle nat
>   do
>     iptables -I $chain -t $table -j LOG --log-prefix="$chain $table "
>   done
> done
Yes, but I was hoping to avoid it :-)

-- 
Neo: 'Can you fly that thing?'
Trinity: 'Not yet'.
$ apt-get install pilot-prg-v212helicopter.