* curious about address specification and port specification
@ 2002-10-09 11:14 Robert P. J. Day
2002-10-09 21:13 ` Antony Stone
0 siblings, 1 reply; 6+ messages in thread
From: Robert P. J. Day @ 2002-10-09 11:14 UTC (permalink / raw)
To: netfilter mailing list
more annoying questions, before i head out for the day:
1) is there anything meaningful about some sample address filter
clauses i've seen that read "-s 0/0" or "-d 0/0"? doesn't
this just mean no filtering on either source or destination?
is there any value to these matches other than making it
explicitly clear that no address filtering is being done?
2) in all of the docs i've read, the claim is that port matching is
an implicit match within either UDP or TCP matching and that you
*must* specify a protocol before you're allowed to specify ports.
however, i've certainly seen and used rules that refer to a port
or ports without first specifying a protocol. is the documentation
just misleading here?
rday
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: curious about address specification and port specification
2002-10-09 11:14 curious about address specification and port specification Robert P. J. Day
@ 2002-10-09 21:13 ` Antony Stone
2002-10-09 21:57 ` Robert P. J. Day
0 siblings, 1 reply; 6+ messages in thread
From: Antony Stone @ 2002-10-09 21:13 UTC (permalink / raw)
To: netfilter mailing list
On Wednesday 09 October 2002 12:14 pm, Robert P. J. Day wrote:
> more annoying questions, before i head out for the day:
>
> 1) is there anything meaningful about some sample address filter
> clauses i've seen that read "-s 0/0" or "-d 0/0"?
No, this is not meaningful, and in my opinion should be removed from rules
because it only clutters them up and serves to confuse peope about what it
might mean.
> doesn't
> this just mean no filtering on either source or destination?
> is there any value to these matches other than making it
> explicitly clear that no address filtering is being done?
No. -s 0/0 means "any source", and -d 0/0 means "any destination".
> 2) in all of the docs i've read, the claim is that port matching is
> an implicit match within either UDP or TCP matching and that you
> *must* specify a protocol before you're allowed to specify ports.
This is correct. The --dport or --sport options are invalid without also
specifying -p tcp or -p udp
> however, i've certainly seen and used rules that refer to a port
> or ports without first specifying a protocol. is the documentation
> just misleading here?
Can you give an example of a rule which works, and which specified a port but
not a protocol ?
Antony.
--
Which part of 'apt-get dist-upgrade' do you not understand ???
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: curious about address specification and port specification
2002-10-09 21:13 ` Antony Stone
@ 2002-10-09 21:57 ` Robert P. J. Day
2002-10-10 4:20 ` Sascha Reissner
2002-10-10 6:30 ` Antony Stone
0 siblings, 2 replies; 6+ messages in thread
From: Robert P. J. Day @ 2002-10-09 21:57 UTC (permalink / raw)
To: netfilter mailing list
On Wed, 9 Oct 2002, Antony Stone wrote:
> i wrote:
> > 2) in all of the docs i've read, the claim is that port matching is
> > an implicit match within either UDP or TCP matching and that you
> > *must* specify a protocol before you're allowed to specify ports.
>
> This is correct. The --dport or --sport options are invalid without also
> specifying -p tcp or -p udp
>
> > however, i've certainly seen and used rules that refer to a port
> > or ports without first specifying a protocol. is the documentation
> > just misleading here?
>
> Can you give an example of a rule which works, and which specified a port but
> not a protocol ?
just the other day, i was at a local LUG meeting and a guy was giving a
quick tutorial on iptables and displayed a sample rule file that contained
the rule:
iptables -A FORWARD --destination 172.16.0.2 --destination-port 25 \
--jump ACCEPT
doesn't this represent an example of what i was asking about? a
reference to a port with no reference to protocol.
rday
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: curious about address specification and port specification
2002-10-09 21:57 ` Robert P. J. Day
@ 2002-10-10 4:20 ` Sascha Reissner
2002-10-10 9:16 ` Robert P. J. Day
2002-10-10 6:30 ` Antony Stone
1 sibling, 1 reply; 6+ messages in thread
From: Sascha Reissner @ 2002-10-10 4:20 UTC (permalink / raw)
To: Robert P. J. Day, netfilter mailing list
From: "Robert P. J. Day" <rpjday@mindspring.com>
> just the other day, i was at a local LUG meeting and a guy was giving a
> quick tutorial on iptables and displayed a sample rule file that contained
> the rule:
>
> iptables -A FORWARD --destination 172.16.0.2 --destination-port 25 \
> --jump ACCEPT
>
> doesn't this represent an example of what i was asking about? a
> reference to a port with no reference to protocol.
well, a flipchart, whiteboard or video beamer presentation wont spit out any
error messages...
a real computer will do, and it will tell you that --destination-port is an
invalid parameter in that case..
because you dont specify any protocol ;)
iptables v1.2.6a: Unknown arg `--destination-port'
Try `iptables -h' or 'iptables --help' for more information.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: curious about address specification and port specification
2002-10-10 4:20 ` Sascha Reissner
@ 2002-10-10 9:16 ` Robert P. J. Day
0 siblings, 0 replies; 6+ messages in thread
From: Robert P. J. Day @ 2002-10-10 9:16 UTC (permalink / raw)
To: netfilter mailing list
On Thu, 10 Oct 2002, Sascha Reissner wrote:
> From: "Robert P. J. Day" <rpjday@mindspring.com>
>
> > just the other day, i was at a local LUG meeting and a guy was giving a
> > quick tutorial on iptables and displayed a sample rule file that contained
> > the rule:
> >
> > iptables -A FORWARD --destination 172.16.0.2 --destination-port 25 \
> > --jump ACCEPT
> >
> > doesn't this represent an example of what i was asking about? a
> > reference to a port with no reference to protocol.
>
> well, a flipchart, whiteboard or video beamer presentation wont spit out any
> error messages...
>
> a real computer will do, and it will tell you that --destination-port is an
> invalid parameter in that case..
>
> because you dont specify any protocol ;)
>
> iptables v1.2.6a: Unknown arg `--destination-port'
> Try `iptables -h' or 'iptables --help' for more information.
apparently, it was my misunderstanding. i thought the presenter was
displaying the contents of his *actual* rules file, when he had just
lashed together a sample file for the purposes of the talk without
actually testing the file. argh. so, yes, the rule in question is
in fact invalid.
i have *got* to stop taking people at their word. :-) thanks for all
your patience, i think i have a pretty good handle on all this now.
rday
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: curious about address specification and port specification
2002-10-09 21:57 ` Robert P. J. Day
2002-10-10 4:20 ` Sascha Reissner
@ 2002-10-10 6:30 ` Antony Stone
1 sibling, 0 replies; 6+ messages in thread
From: Antony Stone @ 2002-10-10 6:30 UTC (permalink / raw)
To: netfilter mailing list
On Wednesday 09 October 2002 10:57 pm, Robert P. J. Day wrote:
> On Wed, 9 Oct 2002, Antony Stone wrote:
> > The --dport or --sport options are invalid without
> > also specifying -p tcp or -p udp
> >
> > Can you give an example of a rule which works, and which specified a port
> > but not a protocol ?
>
> just the other day, i was at a local LUG meeting and a guy was giving a
> quick tutorial on iptables and displayed a sample rule file that contained
> the rule:
>
> iptables -A FORWARD --destination 172.16.0.2 --destination-port 25 \
> --jump ACCEPT
>
> doesn't this represent an example of what i was asking about? a
> reference to a port with no reference to protocol.
Yes, it does. However, I do not believe it is an example of a rule which
works. Try it on a netfilter machine and see.
Antony.
--
If you want to be happy for an hour, get drunk.
If you want to be happy for a year, get married.
If you want to be happy for a lifetime, get a garden.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2002-10-10 9:16 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-10-09 11:14 curious about address specification and port specification Robert P. J. Day
2002-10-09 21:13 ` Antony Stone
2002-10-09 21:57 ` Robert P. J. Day
2002-10-10 4:20 ` Sascha Reissner
2002-10-10 9:16 ` Robert P. J. Day
2002-10-10 6:30 ` Antony Stone
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox