curious about address specification and port specification

curious about address specification and port specification

[Robert P. J. Day]

  more annoying questions, before i head out for the day:

1) is there anything meaningful about some sample address filter
   clauses i've seen that read "-s 0/0" or "-d 0/0"?  doesn't 
   this just mean no filtering on either source or destination?
   is there any value to these matches other than making it 
   explicitly clear that no address filtering is being done?

2) in all of the docs i've read, the claim is that port matching is
   an implicit match within either UDP or TCP matching and that you 
   *must* specify a protocol before you're allowed to specify ports.

   however, i've certainly seen and used rules that refer to a port
   or ports without first specifying a protocol.  is the documentation
   just misleading here?

rday

Re: curious about address specification and port specification

[Antony Stone]

On Wednesday 09 October 2002 12:14 pm, Robert P. J. Day wrote:

>   more annoying questions, before i head out for the day:
>
> 1) is there anything meaningful about some sample address filter
>    clauses i've seen that read "-s 0/0" or "-d 0/0"?

No, this is not meaningful, and in my opinion should be removed from rules 
because it only clutters them up and serves to confuse peope about what it 
might mean.

>    doesn't
>    this just mean no filtering on either source or destination?
>    is there any value to these matches other than making it
>    explicitly clear that no address filtering is being done?

No.   -s 0/0 means "any source", and -d 0/0 means "any destination".

> 2) in all of the docs i've read, the claim is that port matching is
>    an implicit match within either UDP or TCP matching and that you
>    *must* specify a protocol before you're allowed to specify ports.

This is correct.   The --dport or --sport options are invalid without also 
specifying -p tcp or -p udp

>    however, i've certainly seen and used rules that refer to a port
>    or ports without first specifying a protocol.  is the documentation
>    just misleading here?

Can you give an example of a rule which works, and which specified a port but 
not a protocol ?

Antony.

-- 

Which part of 'apt-get dist-upgrade' do you not understand ???

Re: curious about address specification and port specification

[Robert P. J. Day]

On Wed, 9 Oct 2002, Antony Stone wrote:

> i wrote:

> > 2) in all of the docs i've read, the claim is that port matching is
> >    an implicit match within either UDP or TCP matching and that you
> >    *must* specify a protocol before you're allowed to specify ports.
> 
> This is correct.   The --dport or --sport options are invalid without also 
> specifying -p tcp or -p udp
> 
> >    however, i've certainly seen and used rules that refer to a port
> >    or ports without first specifying a protocol.  is the documentation
> >    just misleading here?
> 
> Can you give an example of a rule which works, and which specified a port but 
> not a protocol ?

just the other day, i was at a local LUG meeting and a guy was giving a
quick tutorial on iptables and displayed a sample rule file that contained
the rule:

  iptables -A FORWARD --destination 172.16.0.2 --destination-port 25  \
--jump ACCEPT

  doesn't this represent an example of what i was asking about?  a
reference to a port with no reference to protocol.

rday

Re: curious about address specification and port specification

[Sascha Reissner]

From: "Robert P. J. Day" <rpjday@mindspring.com>

> just the other day, i was at a local LUG meeting and a guy was giving a
> quick tutorial on iptables and displayed a sample rule file that contained
> the rule:
>
>   iptables -A FORWARD --destination 172.16.0.2 --destination-port 25  \
> --jump ACCEPT
>
>   doesn't this represent an example of what i was asking about?  a
> reference to a port with no reference to protocol.

well, a flipchart, whiteboard or video beamer presentation wont spit out any
error messages...

a real computer will do, and it will tell you that --destination-port is an
invalid parameter in that case..

because you dont specify any protocol ;)

iptables v1.2.6a: Unknown arg `--destination-port'
Try `iptables -h' or 'iptables --help' for more information.

Re: curious about address specification and port specification

[Antony Stone]

On Wednesday 09 October 2002 10:57 pm, Robert P. J. Day wrote:

> On Wed, 9 Oct 2002, Antony Stone wrote:

> > The --dport or --sport options are invalid without
> > also specifying -p tcp or -p udp
> >
> > Can you give an example of a rule which works, and which specified a port
> > but not a protocol ?
>
> just the other day, i was at a local LUG meeting and a guy was giving a
> quick tutorial on iptables and displayed a sample rule file that contained
> the rule:
>
>   iptables -A FORWARD --destination 172.16.0.2 --destination-port 25  \
> --jump ACCEPT
>
>   doesn't this represent an example of what i was asking about?  a
> reference to a port with no reference to protocol.

Yes, it does.   However, I do not believe it is an example of a rule which 
works.   Try it on a netfilter machine and see.

Antony.

-- 

If you want to be happy for an hour, get drunk.
If you want to be happy for a year, get married.
If you want to be happy for a lifetime, get a garden.

Re: curious about address specification and port specification

[Robert P. J. Day]

On Thu, 10 Oct 2002, Sascha Reissner wrote:

> From: "Robert P. J. Day" <rpjday@mindspring.com>
> 
> > just the other day, i was at a local LUG meeting and a guy was giving a
> > quick tutorial on iptables and displayed a sample rule file that contained
> > the rule:
> >
> >   iptables -A FORWARD --destination 172.16.0.2 --destination-port 25  \
> > --jump ACCEPT
> >
> >   doesn't this represent an example of what i was asking about?  a
> > reference to a port with no reference to protocol.
> 
> well, a flipchart, whiteboard or video beamer presentation wont spit out any
> error messages...
> 
> a real computer will do, and it will tell you that --destination-port is an
> invalid parameter in that case..
> 
> because you dont specify any protocol ;)
> 
> iptables v1.2.6a: Unknown arg `--destination-port'
> Try `iptables -h' or 'iptables --help' for more information.

apparently, it was my misunderstanding.  i thought the presenter was
displaying the contents of his *actual* rules file, when he had just
lashed together a sample file for the purposes of the talk without 
actually testing the file.  argh.  so, yes, the rule in question is
in fact invalid.

i have *got* to stop taking people at their word. :-)  thanks for all
your patience, i think i have a pretty good handle on all this now.

rday