If I don't want to receive certain ports at all in my server I would rather drop such packets as early as possible, ie: before doing the routing.

sudo iptables -I PREROUTING -p tcp --dport 80 -j DROP
iptables: No chain/target/match by that name.

Is there a reason for not having the PREROUTING hook in the filter table?


There is no PREROUTING chain in filter simply because it wouldn't make sense there. When packets reach the filter table of netfilter, all routing is already done.

See this answer and specially this diagram to understand how packets move through netfilter.

As for filtering the packets as early as possible, the diagram shows that raw table would be the earliest possible with PREROUTING chain. See this for more information.

  • "When packets reach the filter table of netfilter, all routing is already done." - well, yes, because currently filter table has no hook before the routing decision. Your reasoning is circular. Looks like using the raw table is an option. But typically raw table is not used for filtering. Not providing the option to filter as early as possible in the table that is intended for filtering seems odd.
    – Manohar
    Jul 13 '17 at 20:14
  • 1
    Well you can always use mangle if you don't mind the overhead of conntrack. As for my circular logic, if you're questioning the design decision itself, my guess is that it is simply more efficient. You'd have to traverse filter table twice for each packet entering server. If you need to drop it before first routing decision, use another table. Filter filters after it's clear where the packet is supposed to go - IMHO you're debating philosophy...
    – Marek Rost
    Jul 13 '17 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.