On Mon, 2004-12-20 at 15:40, R. DuFresne wrote: > That was the rational of my asking if a rule that specified a "-i > /dev/ppp0 -d /dev/eth0" setup would be a FORWARD rhather then a INPUT > rule, as we are crossing interfaces with such a rule. no. a packet destined for a local IP address does not traverse the FORWARD chain. one a packets passes through: MANGLE->PREROUTING | | NAT->PREROUTING the kernel then performs a route lookup on the destination of the packet: if local -> INPUT if ! local -> FORWARD the decision of whether the destination of the packet is local is not influenced at all by what interface the packet was received on. i'm not sure i'm explaining this as well as a kernel developer could, but i don't think i can make it any clearer. -j -- "I'm having the best day of my life, and I owe it all to not going to Church!" --The Simpsons
