Iptables Tutorial 1.2.2

ОглавлениеДобавить в закладки К обложке

Table 6-3. Forwarded packets

Step Table Chain Comment
1     On the wire (i.e., Internet)
2     Comes in on the interface (i.e., eth0)
3 raw PREROUTING Here you can set a connection to not be handled by the connection tracking system.
4     This is where the non-locally generated connection tracking takes place, and is also discussed more in detail in the The state machine chapter.
5 mangle PREROUTING This chain is normally used for mangling packets, i.e., changing TOS and so on.
6 nat PREROUTING This chain is used for DNAT mainly. SNAT is done further on. Avoid filtering in this chain since it will be bypassed in certain cases.
7     Routing decision, i.e., is the packet destined for our local host or to be forwarded and where.
8 mangle FORWARD The packet is then sent on to the FORWARD chain of the mangle table. This can be used for very specific needs, where we want to mangle the packets after the initial routing decision, but before the last routing decision made just before the packet is sent out.
9 filter FORWARD The packet gets routed onto the FORWARD chain. Only forwarded packets go through here, and here we do all the filtering. Note that all traffic that's forwarded goes through here (not only in one direction), so you need to think about it when writing your rule-set.
10 mangle POSTROUTING This chain is used for specific types of packet mangling that we wish to take place after all kinds of routing decisions have been done, but still on this machine.
11 nat POSTROUTING This chain should first and foremost be used for SNAT. Avoid doing filtering here, since certain packets might pass this chain without ever hitting it. This is also where Masquerading is done.
12     Goes out on the outgoing interface (i.e., eth1).
13     Out on the wire again (i.e., LAN).

As you can see, there are quite a lot of steps to pass through. The packet can be stopped at any of the iptables chains, or anywhere else if it is malformed; however, we are mainly interested in the iptables aspect of this lot. Do note that there are no specific chains or tables for different interfaces or anything like that. FORWARD is always passed by all packets that are forwarded over this firewall/router.

Caution Do not use the INPUT chain to filter on in the previous scenario! INPUT is meant solely for packets to our local host that do not get routed to any other destination.

We have now seen how the different chains are traversed in three separate scenarios. If we were to figure out a good map of all this, it would look something like this:

To clarify this image, consider this. If we get a packet into the first routing decision that is not destined for the local machine itself, it will be routed through the FORWARD chain. If the packet is, on the other hand, destined for an IP address that the local machine is listening to, we would send the packet through the INPUT chain and to the local machine.


-= 87 =-
Регистрация.
Забыли пароль?
Логин
Пароль
Запомнить меня