Re: multiport needs `-p tcp', `-p udp' - Why?

[Mart Frauenlob <mart.frauenlob@chello.at>]

On 27.02.2010 17:17, netfilter-owner@vger.kernel.org wrote:
> U'll have to let me know why "-p udp" is needed when the chain can only
> have udp packets, and therefor can only process udp packets.
> 
> I dont want to test over (( and over ) and over ) again when I know that
> the packet is already KNOWN to be from eth1 and of protocol UDP.

now if we add -p icmp -j PRE_UDP,  what should iptables do now?

use 'ferm' if you are too lazy to write iptables rules:
http://ferm.foo-projects.org/

> 
> adding "-p UDP" to multiport does make iptables happy, but appears to be
> a useless test.
> 
> On 02/27/2010 10:06 AM, ratheesh k wrote:
>> Port is in Layer 4 of protocol stack .

Very useless response ...


>>
>>
>> On Sat, Feb 27, 2010 at 8:33 PM, U. George<netbeans@gatworks.com>  wrote:
>>> In order to get to the chain, the protocol, as well as the interface
>>> must
>>> match. PRE_UDP if already filtered for "-p udp" . So why does multiport
>>> require another check for -p udp? Does it really need to have that
>>> option in
>>> order for it to work?
>>>
>>>> + /sbin/iptables -t filter -N PRE_UDP
>>>> + /sbin/iptables -t filter -A INPUT -i eth1 -p udp -j PRE_UDP
>>>> + /sbin/iptables -t filter -A PRE_UDP -m multiport --dport
>>>> 137,138,139,512,514,515,1433,1434 -j DROP
>>>> iptables v1.4.5: multiport needs `-p tcp', `-p udp', `-p udplite', `-p
>>>> sctp' or `-p dccp'
>>>> Try `iptables -h' or 'iptables --help' for more information.


TOP POSTING is <-- censored -->...