Re: multiport needs `-p tcp', `-p udp' - Why?

["Dennis J." <dennisml@conversis.de>]

Rules are independent. The port rule does inherit anything from the chain 
rule so when you tell iptables to block port(s) you have to specify the 
protocol again.

Regards,
   Dennis

On 02/27/2010 05:17 PM, U. George wrote:
> U'll have to let me know why "-p udp" is needed when the chain can only
> have udp packets, and therefor can only process udp packets.
>
> I dont want to test over (( and over ) and over ) again when I know that
> the packet is already KNOWN to be from eth1 and of protocol UDP.
>
> adding "-p UDP" to multiport does make iptables happy, but appears to be
> a useless test.
>
> On 02/27/2010 10:06 AM, ratheesh k wrote:
>> Port is in Layer 4 of protocol stack .
>>
>>
>> On Sat, Feb 27, 2010 at 8:33 PM, U. George<netbeans@gatworks.com> wrote:
>>> In order to get to the chain, the protocol, as well as the interface
>>> must
>>> match. PRE_UDP if already filtered for "-p udp" . So why does multiport
>>> require another check for -p udp? Does it really need to have that
>>> option in
>>> order for it to work?
>>>
>>>> + /sbin/iptables -t filter -N PRE_UDP
>>>> + /sbin/iptables -t filter -A INPUT -i eth1 -p udp -j PRE_UDP
>>>> + /sbin/iptables -t filter -A PRE_UDP -m multiport --dport
>>>> 137,138,139,512,514,515,1433,1434 -j DROP
>>>> iptables v1.4.5: multiport needs `-p tcp', `-p udp', `-p udplite', `-p
>>>> sctp' or `-p dccp'
>>>> Try `iptables -h' or 'iptables --help' for more information.
>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>
>>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html