0

I was given this set of iptables rule that supposedly works.

iptables -A FORWARD -p tcp --syn --dport 5213 -m limit --limit 120/m --limit-burst 1 -j ACCEPT
iptables -A FORWARD -p tcp --syn --dport 5213 -j DROP

I understand the part about limiting the number of TCP-SYNs that are accepted. What I'm confused about is how the FORWARD chain was used.

I usually see rules under the FORWARD chain specifying the source/destination IP address, but the rules above only specified the destination port.

Does this mean that the destination is still the system that received this message? If so, what would be the difference if I used the INPUT chain instead?

Improve this question
3
  • FORWARD is for packets passing through your box. INPUT is only for packets destined for that box.
    – chicks
    Oct 26, 2017 at 1:15
  • I know that part, but where would it be forwarded to if it didn't specify the destination IP address?
    – thedandyman
    Oct 26, 2017 at 1:44
  • These rules aren't changing the routing. The normal ip route rules should apply. Since it is a FORWARD rule it would rate limit this port for any destinations or origins.
    – chicks
    Oct 26, 2017 at 1:47

1 Answer 1

Reset to default
1

As @chicks says in the comments, default routing rules apply. Once the packet exits a FORWARD chain as ACCEPTed, it will leave the system according to the routing table.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .