Hmmm . . . someone correct me if I'm wrong but I think your first rule will end processing in the nat table but the packet will still pass to the FORWARD table where, if it does not match a rule, it will be handled by your FORWARD chain policy - JohnHi again
I'm probably thinking to much here but I've got a bit of a problem with allowing traffic from my local network out to the Internet. Currently I've got the following rules which should do that:
# Allow traffic from LAN to WAN $IPT -t nat -A PREROUTING -i $LAN -s $LOCAL_NET -j ACCEPT $IPT -t filter -A FORWARD -i $LAN -o $WAN -s $LOCAL_NET -j ACCEPT $IPT -t nat -A POSTROUTING -o $WAN -s $LOCAL_NET -j MASQUERADE
My problem is with the first rule, where I'm uding the "nat" table but I'm not doing any NATing, more like filtering since I only pass some packets. And filtering is not supposed to be done in the "nat" table but on the other hand there is no filter table in PREROUTING.
But the alternative would be to have a ACCEPT policy in the PREROUTING-chain and do all the filtering in the FORWARD-chain, which is kind of unnecessary since a number of packets would then have to travel through a number of rules (larger than the number of rules in the PREROUTING-chain) just to be droped in the end. So is my rule OK to use or would you do in any other way?
-- Erik Wikström
--
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@xxxxxxxxxxxxx
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net
