Question about packet flow picture.

Question about packet flow picture.

[Jose Ildefonso Camargo Tolosa]

Hi everybody!

I have been using for quite a while this picture (
http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png ) as a
reference for understanding/teaching iptables packet flow, I know it
is still valid, but I don't know how accurate is it, I mean, there has
been changes to the netfilter code since the time that picture was
made, the first thing you can see is that, there is no raw table
there.

Yes, I know, that's from ebtables site, but It also includes netfilter tables.

Can anybody take a look at it and evaluate whether or not it is still accurate?

Thanks in advance,

Ildefonso Camargo

Re: Question about packet flow picture.

[Billy Crook]

I do not believe it is accurate.  Primarily because  it appears to
indicate that forwarded packets go through the INPUT and OUTPUT
chains, and AFAIK, they do not.

This is much newer, and I believe, more accurate:
http://jengelh.medozas.de/images/nf-packet-flow.png

For something simpler, iptables-only, and less intimidating:
http://dmiessler.com/images/DM_NF.PNG

I have also referenced this in the past:
http://linux-ip.net/nf/nfk-traversal.png

On Mon, Aug 25, 2008 at 18:41, Jose Ildefonso Camargo Tolosa
<ildefonso.camargo@gmail.com> wrote:
> Hi everybody!
>
> I have been using for quite a while this picture (
> http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png ) as a
> reference for understanding/teaching iptables packet flow, I know it
> is still valid, but I don't know how accurate is it, I mean, there has
> been changes to the netfilter code since the time that picture was
> made, the first thing you can see is that, there is no raw table
> there.
>
> Yes, I know, that's from ebtables site, but It also includes netfilter tables.
>
> Can anybody take a look at it and evaluate whether or not it is still accurate?
>
> Thanks in advance,
I
> Ildefonso Camargo
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: Question about packet flow picture.

[Jose Ildefonso Camargo Tolosa]

Hi!

Thanks for the answer!

On Tue, Aug 26, 2008 at 10:53 PM, Billy Crook <billycrook@gmail.com> wrote:
> I do not believe it is accurate.  Primarily because  it appears to
> indicate that forwarded packets go through the INPUT and OUTPUT
> chains, and AFAIK, they do not.
>
> This is much newer, and I believe, more accurate:
> http://jengelh.medozas.de/images/nf-packet-flow.png

Sure it is, it looks pretty much like a "new version" of the one I
use.  I only see one detail, it says that:

OUTPUT (raw) ---> Conntrack ---> OUTPUT (mangle) ----> reroute
check???? ---> OUTPUT (nat)

Shouldn't the "reroute check" go *after* OUTPUT (nat) ?

and I have one doubt:

It says that:

ebtables OUTPUT (nat) --> ebtables OUTPUT (filter) --> ebtables
POSTROUTING (nat) --> Network Output

But, shouldn't it "reroute" the packet after ebtables OUTPUT (nat)?

Once again, thanks for the answer!

Sincerely,

Ildefonso Camargo

Re: Question about packet flow picture.

[Billy Crook]

On Tue, Aug 26, 2008 at 07:56, Jose Ildefonso Camargo Tolosa
<ildefonso.camargo@gmail.com> wrote:
> OUTPUT (raw) ---> Conntrack ---> OUTPUT (mangle) ----> reroute
> check???? ---> OUTPUT (nat)
>
> Shouldn't the "reroute check" go *after* OUTPUT (nat) ?

I'm not sure

> and I have one doubt:
>
> It says that:
>
> ebtables OUTPUT (nat) --> ebtables OUTPUT (filter) --> ebtables
> POSTROUTING (nat) --> Network Output
>
> But, shouldn't it "reroute" the packet after ebtables OUTPUT (nat)?

To where should it reroute?  EBtables lies underneath iptables,
between it and the hardware (usually).  When ebtables is done with the
packet, it'd done with it.

Re: Question about packet flow picture.

[Michal Soltys]

Jose Ildefonso Camargo Tolosa wrote:
> Hi!
> 
> Thanks for the answer!
> 
> On Tue, Aug 26, 2008 at 10:53 PM, Billy Crook <billycrook@gmail.com> wrote:
>> I do not believe it is accurate.  Primarily because  it appears to
>> indicate that forwarded packets go through the INPUT and OUTPUT
>> chains, and AFAIK, they do not.
>>
>> This is much newer, and I believe, more accurate:
>> http://jengelh.medozas.de/images/nf-packet-flow.png
> 
> Sure it is, it looks pretty much like a "new version" of the one I
> use.  I only see one detail, it says that:
> 

I've asked similar question a while ago - check out:

http://marc.info/?t=121380071300007&r=1&w=2