Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some "trusted IPs" that I want to allow full access to my machine with "minimal performance impact". The PREROUTING -t mangle is the first chain a packet will pass, entering the system. Is it valid/allowed to use an -j ACCEPT in the PREROUTING -t mangle Chain??

I am not sure this is allowed, as the PREROUTING chain is before(!!) the internal ROUTING. What happens if I accept a packet in the PREROUTING Chain, will this packet then nevertheless be routed correctly or will -j ACCEPT lead to "bypassing" the Routing?

share|improve this question
add comment

2 Answers

No. You should setup all allow/denies in your filter chain only. Mangle is meant for altering packets in some way.

You could use mangle to setup a fwmark on the traffic if it matches a series of IP addresses and then permit the traffic via a fwmark instead.

share|improve this answer
add comment

In iptables, ACCEPT basically means "done processing this chain, pass the packet to the next chain".

You don't have to do anything in the mangle table; the routing will happen whether you do something there or not. Well, as long as you don't DROP the packet, of course :)

I think the following page will help you understand. It contains 2 nice diagrams on how a packet traverses the netfilter/iptables chains. The first one is more intuitive, the second is more canonical (but sadly out-of-date):

http://vinojdavis.blogspot.com/2010/04/packet-flow-diagrams.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.