[iptables] misleading print

[iptables] misleading print

[U.Mutlu]

I have in my script these statements:
   iptables -A INPUT  -i lo -j ACCEPT
   iptables -A OUTPUT -o lo -j ACCEPT

When doing "iptables -L -n" then the above gets shown as this:
   ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

IMHO, this could easily be misinterpreted if one looks
only at the iptables output, because the crucial info,
ie. that it applies to the "lo" device only, is missing...

Right?

Re: [iptables] misleading print

[Jan Engelhardt]

On Monday 2011-12-05 16:26, U.Mutlu wrote:

> I have in my script these statements:
>  iptables -A INPUT  -i lo -j ACCEPT
>  iptables -A OUTPUT -o lo -j ACCEPT
>
> When doing "iptables -L -n" then the above gets shown as this:
>  ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
>
> IMHO, this could easily be misinterpreted if one looks
> only at the iptables output, because the crucial info,
> ie. that it applies to the "lo" device only, is missing...
>
> Right?

That's why one should use iptables -S or iptables-save.

Re: [iptables] misleading print

[Michal Kubeček]

On Monday 05 of December 2011 16:26EN, U.Mutlu wrote:
> I have in my script these statements:
>    iptables -A INPUT  -i lo -j ACCEPT
>    iptables -A OUTPUT -o lo -j ACCEPT
> 
> When doing "iptables -L -n" then the above gets shown as this:
>    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
> 
> IMHO, this could easily be misinterpreted if one looks
> only at the iptables output, because the crucial info,
> ie. that it applies to the "lo" device only, is missing...

Output of "iptables -L" doesn't show -i and -o matches by default. If 
you want to see them, use "-v" option.

                                                       Michal Kubeèek

Re: [iptables] misleading print

[Jan Engelhardt]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: TEXT/PLAIN; charset="windows-1252", Size: 827 bytes --]

On Monday 2011-12-05 16:44, Michal Kubeček wrote:

>On Monday 05 of December 2011 16:26EN, U.Mutlu wrote:
>> I have in my script these statements:
>>    iptables -A INPUT  -i lo -j ACCEPT
>>    iptables -A OUTPUT -o lo -j ACCEPT
>> 
>> When doing "iptables -L -n" then the above gets shown as this:
>>    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
>> 
>> IMHO, this could easily be misinterpreted if one looks
>> only at the iptables output, because the crucial info,
>> ie. that it applies to the "lo" device only, is missing...
>
>Output of "iptables -L" doesn't show -i and -o matches by default. If 
>you want to see them, use "-v" option.


Let's start a vote (of sorts) for getting rid of -L. Yes, it'll break 
people's oh-so-sacred scripts. But heck, you can't reasonably parse it 
anyway.