Are these iptables rules equivalent?

Question

Can someone tell if these iptables are equivalent?

Version 1

$IPT -F
$IPT -X

$IPT -t nat -A POSTROUTING -s 192.168.0.1/24 -o eth0 -j MASQUERADE

$IPT -A FORWARD -j ACCEPT -i eth1 -s 192.168.0.1/24
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Version 2

$IPT -F
$IPT -X
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P INPUT ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -A POSTROUTING -s 192.168.245.0/24 -j MASQUERADE 

What I find confusing is that Version 1 doesn't have explicit ACCEPT rules and an postrouting accept policy.

Answer 1

The rulesets are equivalent, but:

• The first version accept packets of 192.168.0.1/24 on incoming interface eth1, but there is no final drop for all other packets.

• The initial ruleset at startup is "accept all", so you dont need to set it to this state.

So the first version look like this:

    $IPT -t nat -A POSTROUTING -s 192.168.0.1/24 -o eth0 -j MASQUERADE

    $IPT -A FORWARD -j ACCEPT -i eth1 -s 192.168.0.1/24
    $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

and the second one:

    $IPT -F
    $IPT -X

    $IPT -t nat -A POSTROUTING -s 192.168.245.0/24 -j MASQUERADE 

The difference are the two ACCEPT rules, which have no effect, because there a no DROP rule for other packets.

It is not recommended to filter packets outside of the "filter" tables. So don't drop packets outside "filter" tables. An Example:

    $IPT -t nat -A PRETROUTING -s 192.168.245.0/24 -j DROP

A packet traversal picture for iptables/netfilter: http://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg

A really wonderfull and complete tutorial about iptables/netfilter is here: http://www.frozentux.net/documents/iptables-tutorial/