Rules are independent. The port rule does inherit anything from the chain
rule so when you tell iptables to block port(s) you have to specify the
protocol again.
Regards,
Dennis
On 02/27/2010 05:17 PM, U. George wrote:
U'll have to let me know why "-p udp" is needed when the chain can only
have udp packets, and therefor can only process udp packets.
I dont want to test over (( and over ) and over ) again when I know that
the packet is already KNOWN to be from eth1 and of protocol UDP.
adding "-p UDP" to multiport does make iptables happy, but appears to be
a useless test.
On 02/27/2010 10:06 AM, ratheesh k wrote:
Port is in Layer 4 of protocol stack .
On Sat, Feb 27, 2010 at 8:33 PM, U. George<netbeans@xxxxxxxxxxxx> wrote:
In order to get to the chain, the protocol, as well as the interface
must
match. PRE_UDP if already filtered for "-p udp" . So why does multiport
require another check for -p udp? Does it really need to have that
option in
order for it to work?
+ /sbin/iptables -t filter -N PRE_UDP
+ /sbin/iptables -t filter -A INPUT -i eth1 -p udp -j PRE_UDP
+ /sbin/iptables -t filter -A PRE_UDP -m multiport --dport
137,138,139,512,514,515,1433,1434 -j DROP
iptables v1.4.5: multiport needs `-p tcp', `-p udp', `-p udplite', `-p
sctp' or `-p dccp'
Try `iptables -h' or 'iptables --help' for more information.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
