|
First off, I know this is the LARTC list, but I've
been living on this list for over a year now. :) Now with that said, I'm
probably going to get flamed for my question. :)
I've read that iptables is a first match wins
system. My recent experience is showing that it is a last match wins. I
understand that if a packet is matched in prerouting chain, it may be matched
again in a subsequent chain unless the jump target was drop.
NOTE: I am not using iptables as a true firewall,
much as most people on this list do not. I'm primarily using iptables to mark
packets and drop them for securing my network and to deny all traffic to my
router except for a few exclusive port.s
The following is an excerpt from my router script
on how I'm handling certain traffic to my router and this works: (This example
is a last match wins)
#Deny All Traffic to Interface except SSH and ICMP
$IPTABLES -A FORWARD -i eth+ -t mangle --dst 172.20.0.5 -p icmp -j
ACCEPT
#CMTS Link
$IPTABLES -A FORWARD -i eth+ -t mangle --dst 172.20.0.5 -p ! tcp -j
DROP
#CMTS Link
$IPTABLES -A FORWARD -i eth+ -t mangle --dst 172.20.0.5 -p tcp --dport ! 22
-j DROP #CMTS Link
##Allow SNMP Calls Via MRTG To This Interface Only
$IPTABLES -A FORWARD -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 161 -j ACCEPT $IPTABLES -A FORWARD -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 162 -j ACCEPT This is how I was doing it and it worked: (This example is a first
match wins)
(note: I was routing the fwmark 1 to blackhole)
##Allow SNMP Calls Via MRTG To This Interface Only $IPTABLES -A PREROUTING -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 161 -j ACCEPT $IPTABLES -A PREROUTING -i eth3 -t mangle --src 66.28.168.226 --dst 172.20.0.5 -p udp --dport 162 -j ACCEPT #Deny All Traffic to Interface except SSH and ICMP
$IPTABLES -A PREROUTING -i eth+ -t mangle --dst 172.20.0.5 -p icmp -j
ACCEPT
#CMTS Link
$IPTABLES -A PREROUTING -i eth+ -t mangle --dst 172.20.0.5 -p ! tcp
-j MARK --set-mark
1
#CMTS Link
$IPTABLES -A PREROUTING -i eth+ -t mangle --dst 172.20.0.5 -p tcp --dport !
22 -j MARK --set-mark 1 #CMTS Link
I just need someone to tell me when is iptables using first match wins
versus last match wins. I think I am missing something but I am not sure. I stay
so busy with other tasks that I cannot devote the time that I need and would
like to this. Anyway, many thanks in advance.
Walt Wyndroski
|
