Stateless dropping of packets

Stateless dropping of packets

[Florian Weimer]

Is it possible to drop packets, preferably using 2.4 iptables, before
the packet triggers updates of some caches (e.g. the route cache)?

On one particular host, I saw the route cache explode, despite all
packets being dropped (using a DROP rule).

Re: Stateless dropping of packets

[Kevin Buhr]

Florian Weimer <fw@deneb.enyo.de> writes:
>
> Is it possible to drop packets, preferably using 2.4 iptables, before
> the packet triggers updates of some caches (e.g. the route cache)?

If you DROP the packet in a PREROUTING chain, that should work.  Since
the "filter" table doesn't have a PREROUTING chain, you need to use a
table that does, like the "mangle" table.  For example:

        iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP

should drop everything with a source in 10.0.0.0/8 without touching
the routing cache.

-- 
Kevin <buhr@telus.net>

Re: Stateless dropping of packets

[Florian Weimer]

Kevin Buhr <buhr@telus.net> writes:

>> Is it possible to drop packets, preferably using 2.4 iptables, before
>> the packet triggers updates of some caches (e.g. the route cache)?
>
> If you DROP the packet in a PREROUTING chain, that should work.  Since
> the "filter" table doesn't have a PREROUTING chain, you need to use a
> table that does, like the "mangle" table.  For example:
>
>         iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
>
> should drop everything with a source in 10.0.0.0/8 without touching
> the routing cache.

It does, thanks a lot. *phew* Looks as if I don't have to try some
*BSD instead.

Is this extremely important application of the PREROUTING chain
documented somewhere?  Should I feel embarrassed? 8-)

Re: Stateless dropping of packets

[Kevin Buhr]

Florian Weimer <fw@deneb.enyo.de> writes:
> 
> Is this extremely important application of the PREROUTING chain
> documented somewhere?  Should I feel embarrassed? 8-)

No, I haven't seen it documented explicitly.  It's just a fortunate
side effect of the fact that the DROP target can be used anywhere and
there's a fairly general-purpose table ("mangle") that has a
PREROUTING chain.

There's no particular reason for the "filter" table *not* to implement
PREROUTING and POSTROUTING chains (at least not that I can see) except
for a very small performance hit.  I guess no one thought there'd be
much of a use for them.  And it would break the nice rule of thumb
that a packet only passes through one of the three chains of the
"filter" table (not counting packets throught the loopback interface
which pass through OUTPUT then back through INPUT).

-- 
Kevin <buhr@telus.net>