6

I am fairly new to iptables. The picture below shows the order in which chains are evaluated based on my current understanding. If that impression is wrong please let me know.

My question is where in the following diagramm is a custom chain placed when I add it like that?

sudo iptables -N MYCHAIN

I know that command creates a new chain in the filter table, but I am not sure what that means. Are rules of MYCHAIN evaluated before or after rules of the other chains?

http://i.imgur.com/aIRS91L.png

8

After creating a CHAIN you need to add a rule to pass traffic to it. Like

iptables -A INPUT -j MYCHAIN

Now all traffic that reached the end of INPUT will go to MYCHAIN. Then if traffic does not meet any conditions (or meet but with -j RETURN action) in MYCHAIN in continues to flow from the point it went to MYCHAIN. So your chain can be anywhere on a diagram.

4
  • All non terminating target would lead you to jump back to the parent chain in case you don't no other match is found (not only return or no match at all) – alxgomz Oct 9 '14 at 18:20
  • What have I said differently? – Glueon Oct 9 '14 at 18:22
  • 1
    You said "Then if traffic does not meet any conditions", but you can meet a LOG condition (or any non terminating target) and still reach the end of the chain and jump back to the parent chain. – alxgomz Oct 9 '14 at 18:26
  • OK, good point. Totally forgot mentioning other jump targets. – Glueon Oct 9 '14 at 18:27
5

A user defined chain is walked through when a rule from a built-in chain jumps to it. When the user defined chain ends you jump back to rule following the rule that made you jump to the custom rule. If the packet matches a rule in a user defined chain with a terminating target (such as accept) processing ends.

Not sure my wording is clear enough but that's it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.