[LARTC] iptables question

["Walter D. Wyndroski" <wdwrn@friendlycity.net>]

[-- Attachment #1: Type: text/plain, Size: 3051 bytes --]

First off, I know this is the LARTC list, but I've been living on this list for over a year now. :) Now with that said, I'm probably going to get flamed for my question. :)

I've read that iptables is a first match wins system. My recent experience is showing that it is a last match wins. I understand that if a packet is matched in prerouting chain, it may be matched again in a subsequent chain unless the jump target was drop.

NOTE: I am not using iptables as a true firewall, much as most people on this list do not. I'm primarily using iptables to mark packets and drop them for securing my network and to deny all traffic to my router except for a few exclusive port.s



The following is an excerpt from my router script on how I'm handling certain traffic to my router and this works: (This example is a last match wins)

#Deny All Traffic to Interface except SSH and ICMP
$IPTABLES -A FORWARD -i eth+ -t mangle --dst 172.20.0.5 -p icmp -j ACCEPT              #CMTS Link
$IPTABLES -A FORWARD -i eth+ -t mangle --dst 172.20.0.5 -p ! tcp -j DROP                   #CMTS Link
$IPTABLES -A FORWARD -i eth+ -t mangle --dst 172.20.0.5 -p tcp --dport ! 22 -j DROP    #CMTS Link

##Allow SNMP Calls Via MRTG To This Interface Only
$IPTABLES -A FORWARD -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 161 -j ACCEPT
$IPTABLES -A FORWARD -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 162 -j ACCEPT

This is how I was doing it and it worked: (This example is a first match wins)
(note: I was routing the fwmark 1 to blackhole)

##Allow SNMP Calls Via MRTG To This Interface Only
$IPTABLES -A PREROUTING -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 161 -j ACCEPT
$IPTABLES -A PREROUTING -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 162 -j ACCEPT

#Deny All Traffic to Interface except SSH and ICMP
$IPTABLES -A PREROUTING -i eth+ -t mangle --dst 172.20.0.5 -p icmp -j ACCEPT                                #CMTS Link
$IPTABLES -A PREROUTING -i eth+ -t mangle --dst 172.20.0.5 -p ! tcp -j MARK --set-mark 1                  #CMTS Link
$IPTABLES -A PREROUTING -i eth+ -t mangle --dst 172.20.0.5 -p tcp --dport ! 22 -j MARK --set-mark 1    #CMTS Link

I just need someone to tell me when is iptables using first match wins versus last match wins. I think I am missing something but I am not sure. I stay so busy with other tasks that I cannot devote the time that I need and would like to this. Anyway, many thanks in advance.


Walt Wyndroski
**********************************************************************************************
* This message has been scanned by CityNET's email scanner for viruses and dangerous content *
* and is believed to be clean.  CityNET is proud to use MailScanner.  For more information   *
* concerning MailScanner, visit http://www.mailscanner.info                                  *
**********************************************************************************************


[-- Attachment #2: Type: text/html, Size: 4506 bytes --]