Re: input filter

[Georgi Alexandrov <tehlists@hotpop.com>]

Bhasker Allam wrote:

>Hi,
>I am a newbie and I was reading the howto for packet
>filter. The howto has the following picture:
>
>Incoming                 /     \         Outgoing
>       -->[Routing ]--->|FORWARD|------->
>          [Decision]     \_____/        ^
>               |                        |
>               v                       ____
>              ___                     /    \
>             /   \                   |OUTPUT|
>            |INPUT|                   \____/
>             \___/                      ^
>               |                        |
>                ----> Local Process ----
>
>The input filtering is done only for local bound
>packets and after the routing decision. Is the above
>true ? 
>
yes.

>Is there a facility to perform input filtering
>before the routing decision ? Thanks.
>
>  
>
How come you know if it is INPUT or FORWARD before the routing decision ?
Won't the "routing decision" decide if the packet(s) will be destined 
for INPUT (to the local machine) or FORWARD (for the machines behind 
you/gw/fw).

The two chains and tables that are hit by incoming packets before the 
routing decision are:
1. table mangle, chain PREROUTING (from the iptables-tutorial: "This 
chain is normally used for mangling packets, i.e., changing TOS and so on.")
then:
2: table nat, chain PREROUTING (from the iptables-tutorial: "This chain 
is used for DNAT mainly. Avoid filtering in this chain since it will be 
bypassed in certain cases.")

If you explain better your situation i'm sure we'll find reasonable 
solution for your filtering needs ;-)

>Bhasker.
>
>  
>
Georgi Alexandrov.

>__________________________________________________
>Do You Yahoo!?
>Tired of spam?  Yahoo! Mail has the best spam protection around 
>http://mail.yahoo.com 
>
>
>  
>