Order of match extensions

Linux Netfilter discussions
 help / color / mirror / Atom feed

* Order of match extensions
@ 2011-10-06 20:55 Andrew Beverley
  2011-10-06 20:59 ` Jan Engelhardt
  0 siblings, 1 reply; 3+ messages in thread
From: Andrew Beverley @ 2011-10-06 20:55 UTC (permalink / raw)
  To: netfilter

Hi,

Does the order of match extensions matter for iptables rules? Can
someone explain why the following 2 rules produce different results:

1. Matches lots of packets as expected:

iptables -t mangle -A FORWARD -i eth0 -m mark ! --mark 99 \
	-m state --state NEW -m statistic --mode nth --every 1 -j LOG

2. Does not match any packets:

iptables -t mangle -A FORWARD -i eth0 -m state --state NEW \
	-m statistic --mode nth --every 1 -m mark ! --mark 99 -j LOG

The only difference is the place of the "mark" match (either at the end
or the beginning).

(Debian iptables v1.4.8)

Andy

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Order of match extensions
  2011-10-06 20:55 Order of match extensions Andrew Beverley
@ 2011-10-06 20:59 ` Jan Engelhardt
  2011-10-06 22:34   ` Andrew Beverley
  0 siblings, 1 reply; 3+ messages in thread
From: Jan Engelhardt @ 2011-10-06 20:59 UTC (permalink / raw)
  To: Andrew Beverley; +Cc: netfilter

On Thursday 2011-10-06 22:55, Andrew Beverley wrote:

>Hi,
>
>Does the order of match extensions matter for iptables rules?

Clearly.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Order of match extensions
  2011-10-06 20:59 ` Jan Engelhardt
@ 2011-10-06 22:34   ` Andrew Beverley
  0 siblings, 0 replies; 3+ messages in thread
From: Andrew Beverley @ 2011-10-06 22:34 UTC (permalink / raw)
  To: Jan Engelhardt; +Cc: netfilter

On Thu, 2011-10-06 at 22:59 +0200, Jan Engelhardt wrote:
> On Thursday 2011-10-06 22:55, Andrew Beverley wrote:
> 
> >Hi,
> >
> >Does the order of match extensions matter for iptables rules?
> 
> Clearly.

Okay... so why does this rule appear to not match anything?

iptables -t mangle -A FORWARD -i eth0 -m state --state NEW \
        -m statistic --mode nth --every 1 -m mark ! --mark 99 -j LOG

Is the importance of the order documented anywhere?

Thanks,

Andy



^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2011-10-06 22:34 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-06 20:55 Order of match extensions Andrew Beverley
2011-10-06 20:59 ` Jan Engelhardt
2011-10-06 22:34   ` Andrew Beverley

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox