mangle, filter & FORWARD

mangle, filter & FORWARD

[Kevin D. White]

Does a packet that needs to be forwarded ever hit the
INPUT chain? 
What is the relationship between mangle & filter
tables and the chain FORWARD, are there two FORWARD
chains; one for mangle and one for filter or do they
share the same chain?.  
When is the decision to move the packet out the
internal interface made, or is this something I must
specify?

Links to more documentation are welcome answers, thank
you.



	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

Re: mangle, filter & FORWARD

[Justin Friel]

Hi Kevin,

Though, as you know, I'm no expert on iptables, I
think I can answer some of your questions. If I am
incorrect, someone please set me right.

--- "Kevin D. White" <web_crawlz@yahoo.com> wrote:
> Does a packet that needs to be forwarded ever hit
> the
> INPUT chain? 

No, it goes directly to the FORWARD chain.  

Taken directly from the Packet Filtering HOWTO
(http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-6.html):
                         _____
Incoming                 /     \         Outgoing
       -->[Routing ]--->|FORWARD|------->
          [Decision]     \_____/        ^
               |                        |
               v                       ____
              ___                     /    \
             /   \                  |OUTPUT|
            |INPUT|                  \____/
             \___/                      ^
               |                        |
                ----> Local Process ----
   1. When a packet comes in (say, through the
Ethernet card) the kernel first looks at the
destination of the packet: this is called `routing'.
   2. If it's destined for this box, the packet passes
downwards in the diagram, to the INPUT chain. If it
passes this, any processes waiting for that packet
will receive it.
   3. Otherwise, if the kernel does not have
forwarding enabled, or it doesn't know how to forward
the packet, the packet is dropped. If forwarding is
enabled, and the packet is destined for another
network interface (if you have another one), then the
packet goes rightwards on our diagram to the FORWARD
chain. If it is ACCEPTed, it will be sent out.
   4. Finally, a program running on the box can send
network packets. These packets pass through the OUTPUT
chain immediately: if it says ACCEPT, then the packet
continues out to whatever interface it is destined
for.



> What is the relationship between mangle & filter
> tables and the chain FORWARD, are there two FORWARD
> chains; one for mangle and one for filter or do they
> share the same chain?.

Yes, I believe there are two FORWARD chains, this is
from the iptables man page:

filter:
    This is the default table (if no -t option is 
passed).   It contains  the built-in chains INPUT (for
packets coming into the box itself), FORWARD (for
packets being  routed  through the box), and OUTPUT
(for locally-generated packets).
                                                      
                         
nat:
    This  table  is  consulted  when a packet that
creates a new connection is encountered.  It consists
of three  built-ins: PREROUTING  (for  altering
packets as soon as they come in), OUTPUT (for altering
locally-generated packets before  rout-               
ing),  and  POSTROUTING  (for  altering  packets as
they are about to go out).
                                                      
                         
mangle:
    This table is used for specialized packet
alteration.  Until kernel  2.4.17  it  had two
built-in chains: PREROUTING (for altering incoming
packets before routing)  and  OUTPUT  (for altering 
locally-generated  packets before routing).  Since
kernel 2.4.18, three other built-in  chains  are  also
 supported: INPUT (for packets coming into the box
itself), FORWARD (for altering packets being routed 
through  the  box), and  POSTROUTING  (for altering
packets as they are about to go out).


> When is the decision to move the packet out the
> internal interface made, or is this something I must
> specify?
> 

If I am correct the decision is made by the OUTPUT
chain.


Hope this helps,
Justin.


	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

RE: mangle, filter & FORWARD

[Kevin D. White]

*sigh* Thanks for the answers Justin but I was only
asking those questions to start a discussion about
forwarding and maybe find someone that can help you
with your problem.  I have no need for forwarding, I
am merely curious as to what can be done on a network
with a *nix box.  So far I'm impressed with what has
been done, except for my question about the FORWARD
chain... let me explain what I am talking about.

In all the examples I've seen, the way to forward a
packet is to do something like this:

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state
ESTABLISHED,RELATED -j ACCEPT

As you can see, there is no reference to either the
mangle table or filter table... so where does the
system append the rule?  An obvious answer might be
that the system appends the rule in both FORWARD
chains, (if there is two chains).  But that would mean
that a single rule would take up twice the amount of
space it would need and it also brings up something
that occurs with this next, possible answer.
What if there is only one chain, used by two tables. 
Since it seems that the system moves through the
tables sequentially, then the exact same compares will
be made in both tables.  You would have a major
redundancy in a very important part of the networking
process, especially if the system is a gateway.
So there is my question again, restated as clearly as
I can possibly make it.

I have been asking questions as nicely as I can here
and no one wants to reply, so I think I need to say
something to the people who are reading my posts and
just sending them to the bit bucket.

*nix is not user friendly and it is because everyone
who works on it likes to complicate things first, then
simplify (a flaw most people have, myself included). 
*nix will NEVER be user friendly because that is the
way we like it, raw output, difficult challenges and
total control over everything.  The community must
make up for the unfriendly nature of the OS by being
friendly to people who are moving from Windows and
looking for help, like me.  Ignoring people is just
going to make everyone give-up on *nix and stick with
microsoft, which means your *nix knowledge will only
ever be a hobby and you will have to have M$
certification to get work; which would be sad because
this is a far more powerful and useful OS.

If what I said makes you angry, then flame away. 
Better then nothing! :)


	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

RE: mangle, filter & FORWARD

[Daniel Chemko]

> As you can see, there is no reference to either the
> mangle table or filter table...

The filter table is always implied if not explicitly stated otherwise

>so where does the
> system append the rule?  An obvious answer might be
> that the system appends the rule in both FORWARD
> chains, (if there is two chains).

Nope (thankfully)
The MANGLE table's are not for filtering data. Mangle's are typically
used for inline parameter modifications like changing the TOS/MSS/etc...
The order on any given chain is raw/mangle/filter/nat. Not all tables
are run on each chain. Eg. FORWARD table only has mangle/filter.

For a really good refreence on iptables in general, check out
http://iptables-tutorial.frozentux.net/

> *nix is not user friendly and it is because everyone
> who works on it likes to complicate things first, then
> simplify (a flaw most people have, myself included).
> *nix will NEVER be user friendly because that is the
> way we like it, raw output, difficult challenges and
> total control over everything.  The community must
> make up for the unfriendly nature of the OS by being
> friendly to people who are moving from Windows and
> looking for help, like me.  Ignoring people is just
> going to make everyone give-up on *nix and stick with
> microsoft, which means your *nix knowledge will only
> ever be a hobby and you will have to have M$
> certification to get work; which would be sad because
> this is a far more powerful and useful OS.

Yeah, but you can't exepect everyone on a public list to support you
just because your talking. It's too bad that nobody got back to you, but
it does happen from time to time. You may want to rethink your
questions, check external references for more info, make the theme
explicitly clear and resubmit. The questions usually get answered
eventually.

Also note, the questions asked here vary based on their difficulty. You
have questions from newbs (which is fine) asking pretty elementary
questions and you have the pros that generally aim to ask/solve very
technically challenging questions that may/may not involve developing
their own programs/modules to solve the problem. I've been on this ML
for a while and I can say personally that I'd answer a rare higher
difficulty question over a question that's been answered half a dozen
times before (I'm not criticizing, its just what happens to most ppl
learning).

I hope that gives you some insight on the dynamics of mailing lists like
this.

RE: mangle, filter & FORWARD

[Kevin D. White]

--- Daniel Chemko <dchemko@smgtec.com> wrote:
> 
> > As you can see, there is no reference to either
> the
> > mangle table or filter table...
> 
> The filter table is always implied if not explicitly
> stated otherwise

Perfect, thank you.
 
> >so where does the
> > system append the rule?  An obvious answer might
> be
> > that the system appends the rule in both FORWARD
> > chains, (if there is two chains).
> 
> Nope (thankfully)
I know now that there are two FORWARD chains,
mangle.FORWARD and filter.FORWARD.  They have the same
name and are the same chain structure, they will
contain completely different rules.


> The MANGLE table's are not for filtering data.
> Mangle's are typically
> used for inline parameter modifications like
> changing the TOS/MSS/etc...

Yep, I got that much so far

> The order on any given chain is
> raw/mangle/filter/nat. 

I thought the order for a forwarded packet was
mangle/nat/mangle/filter/mangle/nat

>Not all tables
> are run on each chain. Eg. FORWARD table only has
> mangle/filter.

Ok, you must mean "not all the chains are used in each
table", right?  "The FORWARD chains only appear in the
mangle and filter tables", yes?
 
> 
> For a really good refreence on iptables in general,
> check out
> http://iptables-tutorial.frozentux.net/

Right, this document is the source of some my
confussion, for several reasons but mainly because it
never mentioned that although the chains have the same
name and have the same function, they are in fact
different chains.  I think this is because use of the
mangle.FORWARD chain would be a rare occurance and
most of the time it is going to be empty.  



	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

RE: mangle, filter & FORWARD

[Ludo Stellingwerff]

<<snip>>
> > 
> > Nope (thankfully)
> I know now that there are two FORWARD chains,
> mangle.FORWARD and filter.FORWARD.  They have the same
> name and are the same chain structure, they will
> contain completely different rules.

It's quite confusing for people used to working with ipchains:)
The terminology changed a bit:

Chains are now called tables and you have 3 root-tables: mangle, nat and
filter. To select them you would use the '-t' option of iptables,
defaulting to 'filter'.

Then you have 5 'hooks': the places in the network subsystem where these
tables can be used:
PRE-ROUTING, INPUT, FORWARD, OUTPUT, POST-ROUTING

Differents hooks accept different tables: 
the mangle table at all-5 hooks.
the nat table at OUTPUT, PRE- and POST-ROUTING.
and filter table at INPUT, FORWARD and OUTPUT.

> >Not all tables
> > are run on each chain. Eg. FORWARD table only has
> > mangle/filter.
> 
> Ok, you must mean "not all the chains are used in each
> table", right?  "The FORWARD chains only appear in the
> mangle and filter tables", yes?
>  

Therefore it was the correct terminology: not all tables are tun on each
chain (hook).
In ipchains it was the other way around.

> > 
> > For a really good refreence on iptables in general,
> > check out
> > http://iptables-tutorial.frozentux.net/
> 

Did you check the http://lartc.org/howto/ ?
It very clear and handson.

Greetings,

Ludo Stellingwerff.

RE: mangle, filter & FORWARD

[Dick St.Peters]

Ludo Stellingwerff writes:

> Chains are now called tables and you have 3 root-tables: mangle, nat and

This is utterly wrong.  Chains are still called chains.  See
"man iptables" and "iptables --help".  Tables are groups of
related-purpose chains.

> Then you have 5 'hooks': the places in the network subsystem where these
> tables can be used:
> PRE-ROUTING, INPUT, FORWARD, OUTPUT, POST-ROUTING

PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING are the names of
chains.  Fulling specifying a chain requires giving its chain name and
the table it's in.

I realize most users on the list know this, but I felt this
needed correcting for the archives.

> > > For a really good refreence on iptables in general,
> > > check out
> > > http://iptables-tutorial.frozentux.net/
> > 
> 
> Did you check the http://lartc.org/howto/ ?
> It very clear and handson.

It also has very little to do with ntfilter/iptables. 

--
Dick St.Peters, stpeters@NetHeaven.com