Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can someone tell if these iptables are equivalent?

Version 1

$IPT -F
$IPT -X

$IPT -t nat -A POSTROUTING -s 192.168.0.1/24 -o eth0 -j MASQUERADE

$IPT -A FORWARD -j ACCEPT -i eth1 -s 192.168.0.1/24
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Version 2

$IPT -F
$IPT -X
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P INPUT ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -A POSTROUTING -s 192.168.245.0/24 -j MASQUERADE 

What I find confusing is that Version 1 doesn't have explicit ACCEPT rules and an postrouting accept policy.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The rulesets are equivalent, but:

  • The first version accept packets of 192.168.0.1/24 on incoming interface eth1, but there is no final drop for all other packets.

  • The initial ruleset at startup is "accept all", so you dont need to set it to this state.

So the first version look like this:

    $IPT -t nat -A POSTROUTING -s 192.168.0.1/24 -o eth0 -j MASQUERADE

    $IPT -A FORWARD -j ACCEPT -i eth1 -s 192.168.0.1/24
    $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

and the second one:

    $IPT -F
    $IPT -X

    $IPT -t nat -A POSTROUTING -s 192.168.245.0/24 -j MASQUERADE 

The difference are the two ACCEPT rules, which have no effect, because there a no DROP rule for other packets.

It is not recommended to filter packets outside of the "filter" tables. So don't drop packets outside "filter" tables. An Example:

    $IPT -t nat -A PRETROUTING -s 192.168.245.0/24 -j DROP

A packet traversal picture for iptables/netfilter: http://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg

A really wonderfull and complete tutorial about iptables/netfilter is here: http://www.frozentux.net/documents/iptables-tutorial/

share|improve this answer
    
Thanks a lot for clearing that out. What does it mean to "filter packets outside of the filter tables"? Do you have a Wrong and Right example? –  Sandra Oct 21 '11 at 10:20
1  
See my posting for the example –  f4m8 Oct 21 '11 at 10:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.