how can i combine these 2 iprules

how can i combine these 2 iprules

[Technical]

-A RH-Firewall-1-INPUT ! -s cnnp1.com  -j LOG --log-prefix "IPTABLES: "
-A RH-Firewall-1-INPUT ! -s cnnp2.com  -j LOG --log-prefix "IPTABLES: "



-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list

Re: how can i combine these 2 iprules

[Antony Stone]

On Friday 05 March 2004 6:27 pm, Technical wrote:

> -A RH-Firewall-1-INPUT ! -s cnnp1.com  -j LOG --log-prefix "IPTABLES: "
> -A RH-Firewall-1-INPUT ! -s cnnp2.com  -j LOG --log-prefix "IPTABLES: "

iptables -N mychain
iptables -A mychain -s cnnp1.com  -j RETURN
iptables -A mychain -s cnnp2.com  -j RETURN
iptables -A mychain -j LOG --log-prefix "IPTABLES: "
iptables -A RH-Firewall-1-INPUT -j mychain

Note that it is not recommended to use hostnames in netfilter rules - better 
to identify the IP addresses and put them in yourself, to avoid possibly 
hidden problems.

Antony.

-- 
Behind the counter a boy with a shaven head stared vacantly into space,
a dozen spikes of microsoft protruding from the socket behind his ear.

 - William Gibson, Neuromancer (1984)

                                                     Please reply to the list;
                                                           please don't CC me.

Re: how can i combine these 2 iprules

[Technical]

What is -j Return doing

> On Friday 05 March 2004 6:27 pm, Technical wrote:
>
>> -A RH-Firewall-1-INPUT ! -s cnnp1.com  -j LOG --log-prefix "IPTABLES: "
>> -A RH-Firewall-1-INPUT ! -s cnnp2.com  -j LOG --log-prefix "IPTABLES: "
>
> iptables -N mychain
> iptables -A mychain -s cnnp1.com  -j RETURN
> iptables -A mychain -s cnnp2.com  -j RETURN
> iptables -A mychain -j LOG --log-prefix "IPTABLES: "
> iptables -A RH-Firewall-1-INPUT -j mychain
>
> Note that it is not recommended to use hostnames in netfilter rules -
> better
> to identify the IP addresses and put them in yourself, to avoid possibly
> hidden problems.
>
> Antony.
>
> --
> Behind the counter a boy with a shaven head stared vacantly into space,
> a dozen spikes of microsoft protruding from the socket behind his ear.
>
>  - William Gibson, Neuromancer (1984)
>
>                                                      Please reply to the
> list;
>                                                            please don't CC
> me.
>
>

RE: how can i combine these 2 iprules

[Rob Sterenborg]

> > On Friday 05 March 2004 6:27 pm, Technical wrote:
> >
> >> -A RH-Firewall-1-INPUT ! -s cnnp1.com  -j LOG --log-prefix 
> "IPTABLES: "
> >> -A RH-Firewall-1-INPUT ! -s cnnp2.com  -j LOG --log-prefix 
> "IPTABLES: "
> >
> > iptables -N mychain
> > iptables -A mychain -s cnnp1.com  -j RETURN
> > iptables -A mychain -s cnnp2.com  -j RETURN
> > iptables -A mychain -j LOG --log-prefix "IPTABLES: "
> > iptables -A RH-Firewall-1-INPUT -j mychain
>
> What is -j Return doing

Your match is reversed.
You matched everything that does not cnnp1.com and LOGged it. After that you
matched everything that does not match cnnp2.com and LOGged it.
So, you logged everything that matched cnnp1.com or cnnp2.com once, else
twice.

Antony's solution redirects a packet to the "mychain" user chain.
If a packet matches either cnnp1.com or cnnp2.com, it RETURNs to the
"RH-Firewall-1-INPUT" chain.
If a packet didn't match, it gets logged and the "mychain" chain ends, thus
the packet returns to the chain that called it ; the "RH-Firewall-1-INPUT"
chain.


Gr,
Rob

RE: how can i combine these 2 iprules

[Technical]

Ok I got that but i am confused about how true iptables' sequential
execution of rules is.


Say for example that my I ping this machine from a host other than 
cnnp1.com and cnnp2.com. The packet should be logged by >> > iptables -A
mychain -j LOG --log-prefix "IPTABLES: "

My question is should not the execution of the rest of the rules in
RH-Firewall-1-INPUT not happen


>> > On Friday 05 March 2004 6:27 pm, Technical wrote:
>> >
>> >> -A RH-Firewall-1-INPUT ! -s cnnp1.com  -j LOG --log-prefix
>> "IPTABLES: "
>> >> -A RH-Firewall-1-INPUT ! -s cnnp2.com  -j LOG --log-prefix
>> "IPTABLES: "
>> >
>> > iptables -N mychain
>> > iptables -A mychain -s cnnp1.com  -j RETURN
>> > iptables -A mychain -s cnnp2.com  -j RETURN
>> > iptables -A mychain -j LOG --log-prefix "IPTABLES: "
>> > iptables -A RH-Firewall-1-INPUT -j mychain
>>
>> What is -j Return doing
>
> Your match is reversed.
> You matched everything that does not cnnp1.com and LOGged it. After that
> you
> matched everything that does not match cnnp2.com and LOGged it.
> So, you logged everything that matched cnnp1.com or cnnp2.com once, else
> twice.
>
> Antony's solution redirects a packet to the "mychain" user chain.
> If a packet matches either cnnp1.com or cnnp2.com, it RETURNs to the
> "RH-Firewall-1-INPUT" chain.
> If a packet didn't match, it gets logged and the "mychain" chain ends,
> thus
> the packet returns to the chain that called it ; the "RH-Firewall-1-INPUT"
> chain.
>
>
> Gr,
> Rob
>
>

Re: how can i combine these 2 iprules

[Antony Stone]

On Friday 05 March 2004 8:04 pm, Technical wrote:

> Ok I got that but i am confused about how true iptables' sequential
> execution of rules is.
>
> Say for example that my I ping this machine from a host other than
> cnnp1.com and cnnp2.com. The packet should be logged by >> > iptables -A
> mychain -j LOG --log-prefix "IPTABLES: "
>
> My question is should not the execution of the rest of the rules in
> RH-Firewall-1-INPUT not happen

Once a packet RETURNs from a user-defined chain, or gets to the end of a 
user-defined chain (as it will if it matches the LOG target - this target 
does not terminate processing), it continues to be processed through the rest 
of the rules in the built-in chain which called it.

The two rules which you posted in your question only LOGged the packets - did 
not ACCEPT or DROP them, therefore the version I suggested to you in my 
answer did exactly the same - LOG without ACCEPTing or DROPping.

If you want to ACCEPT or DROP the packets and thereby avoid further processing 
in the INPUT chain, do so at the end of the user-defined "mychain".

Antony.

-- 
If you can't find an Open Source solution for it, then it isn't a real 
problem.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: how can i combine these 2 iprules

[Luciano Miguel Ferreira Rocha]

On Fri, Mar 05, 2004 at 01:27:53PM -0500, Technical wrote:
> -A RH-Firewall-1-INPUT ! -s cnnp1.com  -j LOG --log-prefix "IPTABLES: "
> -A RH-Firewall-1-INPUT ! -s cnnp2.com  -j LOG --log-prefix "IPTABLES: "

-N iptlog
-A iptlog -s cnnp1.com -j RETURN
-A iptlog -s cnnp2.com -j RETURN
-A -j LOG --log-prefix "IPTABLES: "

Should do it.

Regards,
Luciano Rocha


-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list