Re: [ANNOUNCE] Release of iptables-1.4.3.2

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Eray Aslan wrote:
On 06.04.2009 17:18, Dennis J. wrote:
What does "deprecation of NAT filtering" entail exactly?

# /sbin/iptables -V
iptables v1.4.2
# /sbin/iptables -t nat -A OUTPUT -p tcp --dport 10000 -j DROP

The "nat" table is not intended for filtering, hence the use of DROP is
deprecated and will permanently be disabled in the next iptables
release. Please adjust your scripts.

# /sbin/iptables -L -nvx -t nat
[...]
Chain OUTPUT (policy ACCEPT 45827 packets, 3301166 bytes)
    pkts      bytes target     prot opt in     out     source
    destination
       0        0 DROP       tcp  --  *      *       0.0.0.0/0
  0.0.0.0/0           tcp dpt:10000
#

versus

# /sbin/iptables -V
iptables v1.4.3.1
# /sbin/iptables -t nat -A OUTPUT -p tcp --dport 10000 -j DROP
iptables v1.4.3.1:
The "nat" table is not intended for filtering, the use of DROP is
therefore inhibited.


Try `iptables -h' or 'iptables --help' for more information.
# /sbin/iptables -L -nvx -t nat
[...]
Chain OUTPUT (policy ACCEPT 5115 packets, 415189 bytes)
    pkts      bytes target     prot opt in     out     source
    destination
#

Do not filter in the nat table and you will be fine.

Hello,

what about the 'policy' in the 'nat' table? Will it allow 'DROP'?

what about the other non 'filter' tables?
Will it be possible to 'DROP' in the mangle table? Or set it's policy to 'DROP'? Isn't dropping in the mangle table almost the same thing as doing that in the nat table?
At least it violates the concept of filtering in the filter table.

What if someone uses 'DROP' rules and policy in the 'raw' table?
Especially setting a drop policy there turns the concept upside down.
I've been reading some advices to do 'blacklisting' in the raw table, which does sound quite reasonable to me, as the raw table is the first to be process, thus speeding up the processing. Though the raw table has been introduces to allow 'NOTRACK'. So, the concept violation makes sense here?
But again, a 'DROP' policy? Needed?

I must say I've always been wondering why the other tables (formerly just mangle and nat) would have the DROP policy available, and why they allow dropping rules, although the iptables concept says to do filtering in the filter table. I've seen quite some people (mostly unexperienced) mess up their box with that, most of them ending up asking for public help.
It seems misleading to me, to make that options available.

Thanks for any information you want to share with me.

Thanks to the developers spending their time and energy.

Greets

Mart
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux