* Order of iptables vs. ip6tables chains
@ 2015-01-23 22:31 Thomas Preissler
2015-01-23 22:38 ` Noel Kuntze
0 siblings, 1 reply; 6+ messages in thread
From: Thomas Preissler @ 2015-01-23 22:31 UTC (permalink / raw)
To: netfilter
Hello folks,
I am wondering in which order are iptables/ip6tables rules executed?
So for example I have the same rules on v4 and v6 on INPUT and FORWARD
matching MAC addresses, interestingly only ipv4's counters are <> 0.
(I know about ebtables.)
So I guess the order is v4 INPUT then v6, after that v4 FORWARD then v6
- for example?
And yes, I can't wait for nftables to go live...
Kind Regards
Thomas
--
www.preissler.co.uk | Twitter: @module0x90 | PGP-Key: 75889415
GPG Fingerprint: CCBD 153A D257 CA7E A217 FDF7 5928 03D1 7588 9415
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Order of iptables vs. ip6tables chains
2015-01-23 22:31 Order of iptables vs. ip6tables chains Thomas Preissler
@ 2015-01-23 22:38 ` Noel Kuntze
2015-01-23 22:38 ` Noel Kuntze
2015-01-23 22:51 ` Thomas Preissler
0 siblings, 2 replies; 6+ messages in thread
From: Noel Kuntze @ 2015-01-23 22:38 UTC (permalink / raw)
To: Thomas Preissler, netfilter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello Thomas,
Inside chains it's top to bottom.
This [1] picture shows where the chains are used.
Also, IPv4 traffic is only handled by iptables rules and IPv6 traffic
obviously only by ip6tables rules. iptables only handles ip traffic, not decnet or any
other fancy layer three protocol.
Mit freundlichen Grüßen/Regards,
Noel Kuntze
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
Am 23.01.2015 um 23:31 schrieb Thomas Preissler:
> Hello folks,
>
> I am wondering in which order are iptables/ip6tables rules executed?
> So for example I have the same rules on v4 and v6 on INPUT and FORWARD
> matching MAC addresses, interestingly only ipv4's counters are <> 0.
> (I know about ebtables.)
>
> So I guess the order is v4 INPUT then v6, after that v4 FORWARD then v6
> - for example?
>
> And yes, I can't wait for nftables to go live...
>
>
> Kind Regards
>
> Thomas
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJUws1iAAoJEDg5KY9j7GZYJqoP/iXHk1uLvEiTVmVpQWQ+bTTC
nc5Yca6cpmRXvBgg5F7k8XK1v4dIbWv2TYPtPA5Sd+UvYIsqq/bFOSwj2nsoqd7k
0p/x6QIpZ2C48uieBJ0mBc8T7aQLSq3jdMnHwxXcKr6iw87xDHKeuvipKNLuLJ0b
c63oh6DgDb+i5z4bVQkTnW1/QAvAohJW4tKmYpMIAB44TN5Ow7cDKH7ZcEdsVrf9
j4RZDovNDMquGH7BjycQhRaBHRUZnB+jfObJ1BkfQn3YbzuqUnnyamU9OjO1bE6k
FRrQ6qnd9/eQww62ADKiBNYTDuVOpfPcLFsdFepP0IhzOuqYlkss7CkrCZMVoPkp
x59sQZTR3Y4/PEwUPB/iNdZn4dd2+kYzW4r4LdEpWDL0vQngARcZw4Ze44FBO9D0
ZEwu/L5sRqtIaInaC++QhoTVCHsjuDs75L0PehC48CKHLN+8HU8R+rNswky0dA/s
iNHU9RxtEsXRLReq0WtmVweMha9ZKooOD7FP/R1BfxZzAhRKp86ZxhA1ycL6fzNd
FzsRz+xt2hsmzcIPHNrJuYaDFP0N7hsISsSa8+B6MvcaXUGxgyCkAfXW6TPzvge6
gOgW8/Cp+tpIjHwSAQLhOxWGTDeNMUlxw5UVzv2/o6BK8lBInICEhd8oE4Egw1Iv
zMjNjY3a8MIVhC26vNJO
=zGrw
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Order of iptables vs. ip6tables chains
2015-01-23 22:38 ` Noel Kuntze
@ 2015-01-23 22:38 ` Noel Kuntze
2015-01-23 22:51 ` Thomas Preissler
1 sibling, 0 replies; 6+ messages in thread
From: Noel Kuntze @ 2015-01-23 22:38 UTC (permalink / raw)
To: Thomas Preissler, netfilter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Forgot the picture: http://inai.de/images/nf-packet-flow.png
Mit freundlichen Grüßen/Regards,
Noel Kuntze
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
Am 23.01.2015 um 23:38 schrieb Noel Kuntze:
>
> Hello Thomas,
>
> Inside chains it's top to bottom.
> This [1] picture shows where the chains are used.
> Also, IPv4 traffic is only handled by iptables rules and IPv6 traffic
> obviously only by ip6tables rules. iptables only handles ip traffic, not decnet or any
> other fancy layer three protocol.
>
> Mit freundlichen Grüßen/Regards,
> Noel Kuntze
>
> GPG Key ID: 0x63EC6658
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
>
> Am 23.01.2015 um 23:31 schrieb Thomas Preissler:
> > Hello folks,
>
> > I am wondering in which order are iptables/ip6tables rules executed?
> > So for example I have the same rules on v4 and v6 on INPUT and FORWARD
> > matching MAC addresses, interestingly only ipv4's counters are <> 0.
> > (I know about ebtables.)
>
> > So I guess the order is v4 INPUT then v6, after that v4 FORWARD then v6
> > - for example?
>
> > And yes, I can't wait for nftables to go live...
>
>
> > Kind Regards
>
> > Thomas
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJUws1+AAoJEDg5KY9j7GZYOsIP/3fIcaWFt6b012if7G+Cg+4l
ThqvCSMCAkFsReMixIHCLGRMlU0P2l+vG86CzL2aFyN6WzHt79K3c8Wf6qJxTExw
N/3vbEAw89xKIMhEZQmjRQn8DlPnU52BqGp6vCoB+JLWqZjk3y6W/81ICoRfxX8Z
Brhc1HiYokcp9wByOIWm3E9EiJ/GtJ9H0wchYit3MFDp8nG67qjLnSuMGILZczZB
9Hzx1ASlGBAw0QtPyR4xTZlTNu1nA2NBgi+5dRGNXmv+u5a7aT0CJEkP6FRS36yj
o0YmFgbqpb68KhIPMA1YfalDq5hkL19+tfD3Iz1o9yH7rive9V/UfOZv+sO+2Ya4
ZFVaR+irsC5xBjkt6HP9aA1XLNvTRiVivM+j97w968sp8tW37dlgr30irSMjh/HJ
MknbaYE1MSEr0f9rigfwgdR/VVeAIXhhUZC6Bq7eE6QMaMvzMonuYEUKR2DfHmkV
JW25DN5HS0hHr5+izX9AYoEDIbJxNMCGIPwdC4Cujg9A/rcqcWMFGdXgUcl4NxaX
4EFQvy0dJqf+ruKNGX5TZDyyHqzH4Lm0IfQ6KdWSc2Hqo15wjx4yfa18Kzs6+voo
4wlRI/SiNympJi+zkiiSQsiaASdtxu01Ip0BTd8ryjR6Zot7j/k7y5THX1QVaqMh
+yd5iy8PaxGm3sBigjpS
=KEVI
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Order of iptables vs. ip6tables chains
2015-01-23 22:38 ` Noel Kuntze
2015-01-23 22:38 ` Noel Kuntze
@ 2015-01-23 22:51 ` Thomas Preissler
2015-01-23 22:58 ` Pascal Hambourg
2015-01-23 22:59 ` Noel Kuntze
1 sibling, 2 replies; 6+ messages in thread
From: Thomas Preissler @ 2015-01-23 22:51 UTC (permalink / raw)
To: netfilter
Noel,
On Fri, Jan 23, 2015 at 11:38:28PM +0100, Noel Kuntze wrote:
> This [1] picture shows where the chains are used.
> Also, IPv4 traffic is only handled by iptables rules and IPv6 traffic
> obviously only by ip6tables rules. iptables only handles ip traffic, not decnet or any
> other fancy layer three protocol.
[1] http://inai.de/images/nf-packet-flow.png
Ah yeah, thanks, I forgot about this picture.
But where does ip6tables fit in here? Does it first run through the
whole netfilter stack as in [1], and then for v6, or is it doing it
in some mixed way:
1) mangle PREROUTING v4
2) mangle PREROUTING v6
3) mangle INPUT v4
4) mangle INPUT v6
5) filter INPUT v4
6) filter INPUT v6
and so on (I skipped NAT... as there is no v6 NAT (haha - I know)).
(It is late here and I am tired and I just can't remember why I needed
to know that.)
Cheers
Thomas
--
www.preissler.co.uk | Twitter: @module0x90 | PGP-Key: 75889415
GPG Fingerprint: CCBD 153A D257 CA7E A217 FDF7 5928 03D1 7588 9415
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Order of iptables vs. ip6tables chains
2015-01-23 22:51 ` Thomas Preissler
@ 2015-01-23 22:58 ` Pascal Hambourg
2015-01-23 22:59 ` Noel Kuntze
1 sibling, 0 replies; 6+ messages in thread
From: Pascal Hambourg @ 2015-01-23 22:58 UTC (permalink / raw)
To: netfilter
Thomas Preissler a écrit :
>
> On Fri, Jan 23, 2015 at 11:38:28PM +0100, Noel Kuntze wrote:
>> Also, IPv4 traffic is only handled by iptables rules and IPv6 traffic
>> obviously only by ip6tables rules. iptables only handles ip traffic, not decnet or any
>> other fancy layer three protocol.
>
> But where does ip6tables fit in here?
In the same places as iptables.
> Does it first run through the
> whole netfilter stack as in [1], and then for v6, or is it doing it
> in some mixed way:
>
> 1) mangle PREROUTING v4
> 2) mangle PREROUTING v6
> 3) mangle INPUT v4
> 4) mangle INPUT v6
> 5) filter INPUT v4
> 6) filter INPUT v6
What is unclear in "IPv4 traffic is only handled by iptables rules and
IPv6 traffic obviously only by ip6tables rules" ?
> and so on (I skipped NAT... as there is no v6 NAT (haha - I know)).
There is.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Order of iptables vs. ip6tables chains
2015-01-23 22:51 ` Thomas Preissler
2015-01-23 22:58 ` Pascal Hambourg
@ 2015-01-23 22:59 ` Noel Kuntze
1 sibling, 0 replies; 6+ messages in thread
From: Noel Kuntze @ 2015-01-23 22:59 UTC (permalink / raw)
To: Thomas Preissler, netfilter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello Thomas,
As a packet only has a single protocol on layer three (IPv4/IPv6/...),
it will only pass through the tables and chains for that particular network protocol
It makes no sense to pass an IPv4 packet through rules for IPv6 traffic.
Mit freundlichen Grüßen/Regards,
Noel Kuntze
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
Am 23.01.2015 um 23:51 schrieb Thomas Preissler:
> Noel,
>
> On Fri, Jan 23, 2015 at 11:38:28PM +0100, Noel Kuntze wrote:
>> This [1] picture shows where the chains are used.
>> Also, IPv4 traffic is only handled by iptables rules and IPv6 traffic
>> obviously only by ip6tables rules. iptables only handles ip traffic, not decnet or any
>> other fancy layer three protocol.
>
> [1] http://inai.de/images/nf-packet-flow.png
>
> Ah yeah, thanks, I forgot about this picture.
> But where does ip6tables fit in here? Does it first run through the
> whole netfilter stack as in [1], and then for v6, or is it doing it
> in some mixed way:
>
> 1) mangle PREROUTING v4
> 2) mangle PREROUTING v6
> 3) mangle INPUT v4
> 4) mangle INPUT v6
> 5) filter INPUT v4
> 6) filter INPUT v6
>
> and so on (I skipped NAT... as there is no v6 NAT (haha - I know)).
>
> (It is late here and I am tired and I just can't remember why I needed
> to know that.)
>
>
> Cheers
>
> Thomas
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJUwtJGAAoJEDg5KY9j7GZYUX8P/1tMo6JgfL/S2xP7DwO8gYV7
vCrl11wG0LsRW2FzanHaDE3leJiu70qtOk2oao1vN25moxMpIIODyBfu5xE0Y+Z7
pc9X4WHFJHqhICMajZ6CQi/iX82doGFCVQ4t+DnJKb0iNGwK9cs5wW2hQ+nTe7yu
25RNATNyeF+gE/EOJgng6uIHxZTqw/EgaXJu3hZYTN5zkc+gyzf7rDzGge9SzM8g
l0X4Y87F72R0DWAPzuXaDq2bJwa4KY5Lk7pS8BMzzGMK5o37xkmXaqANN8+uBfpx
iKiNWK+enwJ0FTHPq32yId0NrAgqT+7N6fI0DyfInb+bDY9q68C5wS7LRK/RLGCN
HIde0txH4R2sqE1BfyVBGjaE/YhUj6OYxGXAqigj1EhyexOQCwKACBev0jUy4HOp
uvGNK6Ogk+RgB9rNfEbC7x76f7djXYvGDqNS3COwF0/ASz1jqQW+TMDodpdRVWpP
L/UBtCTap0US4DE0780UjnaDu36Io1JSpuHrLSbtv9Glr7QiIssvw2kYi93lPVw5
+TbXvHFPTYAhPz/AOQigqQaRHaXaGRwZFnZogDjVV43GXRmla/IWIYyDI4VzNt+F
2PKbXd24XnlHC50QTqBChcRlntLYwvTAru/17d3k6eYWyREIuvrPqsWSjY4K5fVW
3dNHVlbPN+JzYMdYtxm4
=mGs1
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-01-23 22:59 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-01-23 22:31 Order of iptables vs. ip6tables chains Thomas Preissler
2015-01-23 22:38 ` Noel Kuntze
2015-01-23 22:38 ` Noel Kuntze
2015-01-23 22:51 ` Thomas Preissler
2015-01-23 22:58 ` Pascal Hambourg
2015-01-23 22:59 ` Noel Kuntze
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
