All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mike <1100100@gmail.com>
To: Jason Opperisano <opie@817west.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: Policy Misunderstanding: RTFM Guidance Requested.
Date: Wed, 1 Sep 2004 13:53:29 -0400	[thread overview]
Message-ID: <8ca4228204090110537e02c5eb@mail.gmail.com> (raw)
In-Reply-To: <1094057457.1824.11.camel@wolfpack.ljm.dom>

Jason,

Thanks for your response.
I definitely appreciate the help.

On Wed, 01 Sep 2004 12:50:58 -0400, Jason Opperisano <opie@817west.com> wrote:
> > 1.  Can appended rules override default polices?
> 
> yes--for example:
> 
> iptables -P INPUT DROP
> iptables -A INPUT -j ACCEPT

Excellent.  Now I'm clear on this point.

 > if you set the policies of the mangle chains to DROP and then do not
> append any rules, you can be pretty sure that no traffic will get
> through.
> 
> i'd recommend against starting your netfilter adventure by setting the
> policies of nat & mangle chains to DROP.  it will make it a very short
> trip...
> 

This is starting to get clearer after reading some of Adreasson's
tutorial and following the flow of packets traversing the tables.  It
looks like 'mangle' is right there at the beginning of every table
transaction, so my mangle Policy is pre-empting everything else.

Best regards.

Mike


  reply	other threads:[~2004-09-01 17:53 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-09-01  1:01 Mail Server Behind IPTABLES Ajen Diwakar
2004-09-01  4:22 ` George Alexandru Dragoi
2004-09-01 11:54   ` Policy Misunderstanding: RTFM Guidance Requested Mike
2004-09-01 13:27     ` Deepak Seshadri
2004-09-01 15:46       ` Mike
2004-09-01 16:50         ` Jason Opperisano
2004-09-01 17:53           ` Mike [this message]
2004-09-01 17:38         ` Deepak Seshadri
2004-09-01 16:40       ` Mike
2004-09-01 14:44     ` Alistair Tonner
2004-09-01 16:20       ` Mike
2004-09-01 16:53         ` Alistair Tonner
2004-09-01 18:12           ` Mike
2004-09-01 16:43     ` Jason Opperisano
2004-09-01 14:50 ` Mail Server Behind IPTABLES Alistair Tonner
     [not found]   ` <1094054540.5456.16.camel@matevz.net>
2004-09-01 16:27     ` Alistair Tonner
2004-09-01 18:12       ` Matevz
2004-09-01 18:19         ` Jason Opperisano
2004-09-01 18:25           ` Jason Opperisano
2004-09-01 18:23         ` Alistair Tonner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=8ca4228204090110537e02c5eb@mail.gmail.com \
    --to=1100100@gmail.com \
    --cc=netfilter@lists.netfilter.org \
    --cc=opie@817west.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.