Hello,
Rob Sterenborg a écrit :
I have following line to drop any request that is not from the
original computer and it works fine
-A PREROUTING -s 192.168.0.157 -p tcp -m mac --mac-source !
00:11:2F:29:96:84 -j DROP
Is this in the 'nat' table ? Filtering in the 'nat' table is not
recommended. Use the 'filter' table instead.
but now I want to change it to REJECT but it doesnt work and iptables
will fail
-A PREROUTING -s 192.168.0.157 -p tcp -m mac --mac-source !
00:11:2F:29:96:84 -j REJECT --reject-with=icmp-host-pro hibited
what is the problem?
The problem is that the REJECT target intended for filtering and thus is
valid only in the 'filter' table. It cannot be used in the 'nat',
'mangle' or 'raw' tables.
# man iptables
REJECT
[...]
This target is only valid in the INPUT, FORWARD and OUTPUT chains, and
user-defined chains which are only called from those chains.
This is somehow confusing. It should say that the REJECT target is only
valid in the INPUT, FORWARD and OUTPUT chains *of the 'filter' table*.
