Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The article Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals define the RETURN target value as follow:

RETURN – Firewall will stop executing the next set of rules in the current chain for this packet. The control will be returned to the calling chain.

Question

I was discussing with a colleague on the effect of a such a target's value has the first rule of the first chain.

As there is no calling chain, what would happen to the packet? Would it be rejected or accepted?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

You mean e.g.

iptables -F INPUT
iptables -I INPUT 1 -j RETURN

From man iptables:

If [...] a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

The chain policy is set with iptables -P, and can be found at the beginning of the output of iptables -L -n -v, eg:

Chain INPUT (policy DROP 32 packets, 6666 bytes)

which shows a policy of DROP on the INPUT chain.

share|improve this answer
    
What is the target specified by the chain policy here? –  Édouard Lopez Jul 25 at 8:53
    
Will the RETURN be equivalent to a DROP or a ACCEPT? –  Édouard Lopez Jul 25 at 8:53
1  
Neither. As it says above, the RETURN will do nothing at all, and the chain policy will take over. To find or set the chain policy, see my edit above. –  MadHatter Jul 25 at 12:56
    
This is the first answer I found that actually explains RETURN in a simple yet accurate manner. +1 –  aggregate1166877 Sep 5 at 9:39
    
Why, thank you, aggregate! It's nice to know one's efforts are appreciated, and better yet, useful. –  MadHatter Sep 5 at 10:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.