I have the following setup for iptables


   ... More Rules on INPUT ....

How can I return from ChildChain1 back to INPUT just after ParentChain? My understanding RETURN target from ChildChain1 will come out into ParentChain at ChildChain2? How can I RETURN say 2 levels?

My understanding is if i JUMP to INPUT and there are no matches, I will end up back in ChildChain1 (and eventually hit ChidlChain2 which I am essentially trying to skip)

  • I think your firewall is getting too complicated. Can't you make it simpler? – Michael Hampton Oct 27 '14 at 0:30
  • There are programmatic elements to the firewall. I can move the complexity into code, however being able to skip a chain/return to INPUT in the firewall is the simplest solution if its possible. – Adam Mills Oct 27 '14 at 0:45

I agree with @Glueon, in that you really should reconsider your iptables rules, seems unnecessarily complex.

That said, there is a way to do what you want. I'll just give an example:

-A INPUT <some_matches_here> -j ParentChain
-A ParentChain <some_matches_here> -g ChildChain1

The -g switch orders netfilter to perform a GOTO instead of JUMP to the target chain. Therefore, the 'call stack' when filtering branches to ChildChain1 still records INPUT as the 'calling chain'. At the end of ChildChain1, if no matches result in a 'terminating target', netfilter will revert to the INPUT chain.

NOTE: I haven't actually tested this, but based on my knowledge of iptables, it should work that way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.