2

I've been having some trouble with a firewall blocking traffic between two servers recently and want to check how iptables handles multiple rules applying to the same IP. If I run iptables -L -n | grep 1.2.3.4 I see this output:

ACCEPT    all  --  1.2.3.4      0.0.0.0/0
DROP      all  --  1.2.3.4      0.0.0.0/0
ACCEPT    all  --  0.0.0.0/0            1.2.3.4
DROP      all  --  0.0.0.0/0            1.2.3.4

How will iptables process these rules? Will all traffic from 1.2.3.4 be dropped?

Improve this question

3 Answers 3

Reset to default
2

Hard to say since you're not displaying for which chains these rules apply.

Easily said: For a firewall you've got to start with the FORWARD chain and follow all rules that match in sequence until you hit an ACCEPT, DROP or REJECT

If you reach the end of all rules this way, the FORWARD's default policy applies.

Improve this answer
2
  • Lines 1 and 2 above are in the same chain (on sequential lines) and lines 3 and 4 are on sequential lines in a different chain. If I've understood you correctly, if lines 1 and 2 above are in the same chain, and it reaches line 1, it will ignore line 2 - is that right?
    – Dave Child
    Oct 14, 2011 at 9:25
  • yes: 1st one accepts all traffic coming from 1.2.3.4, the 2nd line will never be reached. 3rd line Accepts all traffic going to 1.2.3.4 and the 4th line will never be reached.
    – ktf
    Oct 14, 2011 at 9:55
6

running iptables -L -n does not give you the interface names the rules might have defined as conditions. Rules that look alike with different targets are probably conditioned for different interfaces unless they have been written a) in a hurry b) by an absent-minded admin c) as a temporary workaround for something or d) all of the above

Use iptables -L -v -n instead.

To answer your question: the packet fate is decided by the first matching rule with a terminal target (ACCEPT and DROP are such targets, but there are others like RETURN which are not terminal so the processing goes on). If there is no such rule, the chain default policy applies which is ACCEPT by default and can be changed via iptables -P <ACCEPT, DROP>.

See this rather good workflow document for details.

Improve this answer
3
  • Would that I could accept two answers. ktf cleared it up for me, but I wanted to say thanks for your answer as well as it was very helpful.
    – Dave Child
    Oct 14, 2011 at 10:00
  • 1
    This is what I wanted to confirm: "packet fate is decided by the first matching rule" thanks.
    – PJ Brunet
    May 31, 2013 at 21:12
  • The link is broken
    – Benitok
    Aug 10, 2018 at 4:09
2

My personal favorite of understanding iptables rulesets is the command iptables-save, which dump all rules to stdout. This helps to get the idea of the right order of rules.

A full picture of packet traversal in iptables is here: http://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .