How can it be, that a packet that gets matched by a mangle PREROUTING does not get matched by neither filter INPUT nor filter FORWARD?

From this diagram http://www.64-bit.de/dokumentationen/netzwerk/e/002/DE-IPTABLES-HOWTO-3.html, point 3.5, I take that every packet should go at least one of those two ways. The packets do appear in Wireshark as well.

My three iptables lines are:

iptables -t mangle -A PREROUTING -s -d -j LOG --log-prefix "iptables: "
iptables -t filter -A FORWARD -s -d -j LOG --log-prefix "iptables: "
iptables -t filter -A INPUT -s -d -j LOG --log-prefix "iptables: "

The log only fills with the first rule active, the other two do nothing apparently.

Edit: Interestingly, when using FORWARD and INPUT with mangle, it works as expected. Is there anything special with the filter table that prevents it from working?
Also, with mangle they pass through both, FORWARD and INPUT, which only confuses me even more.

Edit: Output of iptables -L -v -n:

Chain INPUT (policy ACCEPT 5 packets, 280 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       LOG flags 0 level 4 prefix "iptables: "

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       LOG flags 0 level 4 prefix "iptables: "

Chain OUTPUT (policy ACCEPT 2 packets, 100 bytes)
 pkts bytes target     prot opt in     out     source               destination         

with only the first two rules active (the way it doesn't work, but should work).
Another thing to note is, that neither of the two IPs shown is the computer that iptables runs on, the packets go through it nontheless though, due to a man-in-the-middle attack.

  • Is the machine even supposed to be forwarding packets at all? Aug 22, 2014 at 19:04
  • @JoeSniderman The packets do have my MAC address as destination, but not my IP. I guess that means they're supposed to be forwarded, but I'm not sure. Either way, they should at least pass one of the chains if I'm not mistaken?
    – RikuXan
    Aug 22, 2014 at 19:09
  • No, that's not what I'm asking... Do you intend for the machine to be forwarding for anyone? Ie, are you using it as a router? Secondly, is the machine actually forwarding the packets onward? If yes, how have you determined this? Aug 22, 2014 at 19:11
  • And, have you enabled ip forwarding on the machine? Aug 22, 2014 at 19:12
  • I intended for the machine to forward the packets to their actual respective recipients. However, packets are not being forwarded by default and I was also not able to set up any iptables rules to accomplish this. I can tell because the packets are not reaching their actual destination, so they get swallowed. I'm not generally using the machina as a router only for the packets of the two man-in-the-middle targets.
    – RikuXan
    Aug 22, 2014 at 19:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.