target ACCEPT in maccheck chain, forward chain is still used?

target ACCEPT in maccheck chain, forward chain is still used?

[cifroes]

hi,

I'm configuring a machine with iptables to serve as "router" and I have
a rather strange question.

I have to do mac check on one of the networks the router is connected so
I have something like this:
iptables -t mangle -N maccheck
iptables -t mangle -I PREROUTING -i eth1 -j maccheck
iptables -t mangle -A maccheck -m mac -j ACCEPT --mac-source AA:BB:CC...etc
iptables -t mangle -A maccheck -j DROP

(this is not pasted so ignore the typos)

I also have many rules in FORWARD chain.


My question is simple: what happens to the packet when it's marked as
ACCEPT by the 3rd rule? The rules that apply to that packet in the
FORWARD chain are still used or the ACCEPT stuff just overrides everything?


My tests say the FORWARD RULES are still used, am i correct?


(this is kind of a discussion with a mate, so if you can add
documentation to prove it, i will appreciate it...)

Many thx in advance

Re: target ACCEPT in maccheck chain, forward chain is still used?

[Martijn Lievaart]

cifroes wrote:

>hi,
>
>I'm configuring a machine with iptables to serve as "router" and I have
>a rather strange question.
>
>I have to do mac check on one of the networks the router is connected so
>I have something like this:
>iptables -t mangle -N maccheck
>iptables -t mangle -I PREROUTING -i eth1 -j maccheck
>iptables -t mangle -A maccheck -m mac -j ACCEPT --mac-source AA:BB:CC...etc
>iptables -t mangle -A maccheck -j DROP
>
>(this is not pasted so ignore the typos)
>
>I also have many rules in FORWARD chain.
>
>
>My question is simple: what happens to the packet when it's marked as
>ACCEPT by the 3rd rule? The rules that apply to that packet in the
>FORWARD chain are still used or the ACCEPT stuff just overrides everything?
>
>
>My tests say the FORWARD RULES are still used, am i correct?
>
>  
>

Correct. If a packet is ACCEPTed (which may be implicit by falling of a 
chain, in that case the chains policy is applied), processing continues 
with the next chain. Otherwise processing stops.

So if your PREROUTING chain has a policy of ACCEPT (which it should, 
check with iptables-save command), explicitly ACCEPTing a packet is no 
different from falling of the chain. In that last case you already know 
the rest of the chains are applied (think of an empty chain), so it is 
easy to see that any ACCEPT means to continue with the next chain.

HTH,
M4