match many protocol in a rule

match many protocol in a rule

[Mamadou Touré]

Hi all how could i much many protocole in a rule.
I've tried iptable -A INPUT -p tcp,upd --dport 508 -j ACCEPT
but i got error message : iptables v1.4.4: unknown protocol `udp,tcp' specified

regards.

Re: match many protocol in a rule

[Curby]

2010/6/17 Mamadou Touré <e2ia.ci@gmail.com>:
> Hi all how could i much many protocole in a rule.
> I've tried iptable -A INPUT -p tcp,upd --dport 508 -j ACCEPT
> but i got error message : iptables v1.4.4: unknown protocol `udp,tcp' specified

I was looking for a similar feature (as it exists in ipfw) but I don't
think that's possible in iptables.  If you want to specify multiple
protocols for the purpose of ending with a consistent action or set of
actions, you could make the multiple rules jump to a custom chain
which then performs the actions.  However if you want to specify
multiple protocols to reduce the number of rules, I don't think that
will work.

I'd love to hear otherwise though, if anyone has other ideas.

--Mike

Re: match many protocol in a rule

[Grant Taylor]

Curby wrote:
> I was looking for a similar feature (as it exists in ipfw) but I don't
> think that's possible in iptables.  If you want to specify multiple
> protocols for the purpose of ending with a consistent action or set of
> actions, you could make the multiple rules jump to a custom chain
> which then performs the actions.  However if you want to specify
> multiple protocols to reduce the number of rules, I don't think that
> will work.

I also thought about matching the protocols and jumping to a sub-chain. 
  However that won't work the way you want it to b/c (last I checked) 
you have to specify a protocol to be able to specify a port.  So, you 
might as well match both the protocol and the port on the same rule.



Grant. . . .

Re: match many protocol in a rule

[Curby]

On Thu, Jun 17, 2010 at 8:00 PM, Grant Taylor <gtaylor@riverviewtech.net> wrote:
> I also thought about matching the protocols and jumping to a sub-chain.
>  However that won't work the way you want it to b/c (last I checked) you
> have to specify a protocol to be able to specify a port.  So, you might as
> well match both the protocol and the port on the same rule.

Yeah I wasn't clear on that.  You would definitely need to match ports
before jumping, but the idea is that the custom chain could apply a
complex series of actions, e.g. updating a recent match, logging, etc.
 It really depends on what the overarching goal is.  The basic goal of
specifying "allow tcp+udp port 53" in a single rule doesn't seem
possible though.

--Mike

Re: match many protocol in a rule

[Steve Fink]

For tcp/53 + udp/53: TCP and UDP have the port at the same offset. You
could use a 'u32' (or 'string') match using the offset of the port
field. (The source port is the 16 bits just after the IP header; the
destination port is the next 32 bits.) You'd also have to match the
two protocols numerically.

Just sayin'.