Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am quite unable to find out what the consequences of a missing RETURN-rule at the end of user-defined iptables chains are. Obviously "iptables [missing] return [jump]" are really, really bad keywords to look for.

The manpage and any blog or howto I could dig up just tell me what -j RETURN does (which is quite obvious) but not what happens if it is missing. Also, I cannot seem to set up sane experimental rules to try it out...

iptables -N userchainA
iptables -A INPUT -j userchainA
iptables -N userchainB
iptables -A INPUT -j userchainB
iptables -A INPUT -j ACCEPT

iptables -A userchainA ... # anything here, that DOES NOT MATCH
#### no explicit return from userchainA!

iptables -A userchainB ... # anything here, that DOES NOT MATCH
iptables -A userchainB -j RETURN 

Given these rules, anything works just fine. Packets travel through all the chains and finally hit the ACCEPT from INPUT as if the (missing) -j RETURN from userchainA would be done implicitly. Is this the case?

Why is this working? I would have expected some kind of error or at least a log message about execution falling of a chain.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

When iptables reaches the end of a user-defined chain, flow returns to the next rule in the calling chain. The RETURN is therefore implicit; it does not need to be explicitly given.

share|improve this answer
    
Argh! I knew this would be a short one. Thanks for pointing me to this. –  Karma Fusebox Jan 18 '13 at 2:05
    
Every rule has a default target -- something has to happen if a packet doesn't match any rule in the chain. –  David Schwartz Jan 18 '13 at 5:59
1  
Sorry, David, but only built-in chains can have policies set; user-defined tables, such as the one in this question, can not. Check the man page on iptables -P. –  MadHatter Jan 18 '13 at 6:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.