Bhasker Allam wrote:
Hi, I am a newbie and I was reading the howto for packet filter. The howto has the following picture:
Incoming / \ Outgoing -->[Routing ]--->|FORWARD|-------> [Decision] \_____/ ^ | | v ____ ___ / \ / \ |OUTPUT| |INPUT| \____/ \___/ ^ | | ----> Local Process ----
The input filtering is done only for local bound
packets and after the routing decision. Is the above
true ?
yes.
How come you know if it is INPUT or FORWARD before the routing decision ?Is there a facility to perform input filtering before the routing decision ? Thanks.
Won't the "routing decision" decide if the packet(s) will be destined for INPUT (to the local machine) or FORWARD (for the machines behind you/gw/fw).
The two chains and tables that are hit by incoming packets before the routing decision are:
1. table mangle, chain PREROUTING (from the iptables-tutorial: "This chain is normally used for mangling packets, i.e., changing TOS and so on.")
then:
2: table nat, chain PREROUTING (from the iptables-tutorial: "This chain is used for DNAT mainly. Avoid filtering in this chain since it will be bypassed in certain cases.")
If you explain better your situation i'm sure we'll find reasonable solution for your filtering needs ;-)
Bhasker.
Georgi Alexandrov.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
