From mboxrd@z Thu Jan 1 00:00:00 1970 From: richard lucassen Subject: Re: iptables jump to userdefined chain and ESTABLISHED,RELATED rules Date: Sun, 12 Oct 2003 23:40:49 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20031012234049.587cadaa.netfilter@lucassen.org> References: <20031010132641.2591d3b5.netfilter@lucassen.org> <1065889564.1268.11.camel@elendil.intranet.cartel-securite.net> <20031011194527.17273de9.netfilter@lucassen.org> <20031012111620.GB571@pcw.home.local> <20031012195331.409596fc.netfilter@lucassen.org> <1065984839.4919.59.camel@elendil.intranet.cartel-securite.net> Reply-To: reply2@lucassen.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1065984839.4919.59.camel@elendil.intranet.cartel-securite.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Sun, 12 Oct 2003 20:54:00 +0200 Cedric Blancher wrote: > Not working for SSH. > > In fact, it should work. A TCP SYN flaged as NEW will be sent to > CH_SSH chain, then be accepted by CH_SSH rule that allows NEW packets. > Then further packets are going by. They are ESTABLISHED. > > They match first rule so they are sent to CH_SSH chain. They do not > match the rule, for thieses packets are not NEW. So they hit end of > user chain and are returned to FORWARD chain, rule 2. They match rule > 2 and then get accepted. Yes, sorry, you're right, but I forgot to mention that I have a cleanup rule at the end of the CH_SSH: $IPT -A CH_SSH -j DROP > If it does not work as your's, then you have a drop all rule at the > end of CH_SSH chain (I suppose) that prevents packet from returning > from user chain (CH_SSH here) to calling chain (FORWARD here). You got it right ;-) > To me, the best way to handle this is : > > # ESTABLISHED and RELATED packets are accepted anyway > # We accept them first as they are most treated packets > $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT > > # Then we care of each proto. > $IPT -A FORWARD -p tcp --dport 22 -j CH_SSH > [...] > $IPT -A CH_SSH -m state --state NEW -s 1.2.3.4 -j ACCEPT > > Case 3 works because you enforce ESTABLISHED,RELATED accept in your > use chain. > > I really do think that 1st case is the best way to handle, as it > implies less rules evaluation for each packet. Ok, thanks a lot, it's much clearer now :) R. -- ___________________________________________________________________ Recursion: see recursion +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+