* Order of match extensions
@ 2011-10-06 20:55 Andrew Beverley
2011-10-06 20:59 ` Jan Engelhardt
0 siblings, 1 reply; 3+ messages in thread
From: Andrew Beverley @ 2011-10-06 20:55 UTC (permalink / raw)
To: netfilter
Hi,
Does the order of match extensions matter for iptables rules? Can
someone explain why the following 2 rules produce different results:
1. Matches lots of packets as expected:
iptables -t mangle -A FORWARD -i eth0 -m mark ! --mark 99 \
-m state --state NEW -m statistic --mode nth --every 1 -j LOG
2. Does not match any packets:
iptables -t mangle -A FORWARD -i eth0 -m state --state NEW \
-m statistic --mode nth --every 1 -m mark ! --mark 99 -j LOG
The only difference is the place of the "mark" match (either at the end
or the beginning).
(Debian iptables v1.4.8)
Andy
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Order of match extensions
2011-10-06 20:55 Order of match extensions Andrew Beverley
@ 2011-10-06 20:59 ` Jan Engelhardt
2011-10-06 22:34 ` Andrew Beverley
0 siblings, 1 reply; 3+ messages in thread
From: Jan Engelhardt @ 2011-10-06 20:59 UTC (permalink / raw)
To: Andrew Beverley; +Cc: netfilter
On Thursday 2011-10-06 22:55, Andrew Beverley wrote:
>Hi,
>
>Does the order of match extensions matter for iptables rules?
Clearly.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Order of match extensions
2011-10-06 20:59 ` Jan Engelhardt
@ 2011-10-06 22:34 ` Andrew Beverley
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Beverley @ 2011-10-06 22:34 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: netfilter
On Thu, 2011-10-06 at 22:59 +0200, Jan Engelhardt wrote:
> On Thursday 2011-10-06 22:55, Andrew Beverley wrote:
>
> >Hi,
> >
> >Does the order of match extensions matter for iptables rules?
>
> Clearly.
Okay... so why does this rule appear to not match anything?
iptables -t mangle -A FORWARD -i eth0 -m state --state NEW \
-m statistic --mode nth --every 1 -m mark ! --mark 99 -j LOG
Is the importance of the order documented anywhere?
Thanks,
Andy
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-10-06 22:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-06 20:55 Order of match extensions Andrew Beverley
2011-10-06 20:59 ` Jan Engelhardt
2011-10-06 22:34 ` Andrew Beverley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox