[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Opening :80 through a NATing iptables firewall.

This looks like my chance to ask a couple of questions that I've been harboring for a while.

Vineet sez:

No, that's how it was for ipchains, but not under the 2.4 series
kernel's netfilter system. It looks kinda like this:

PREROUTING                OUTPUT-------------+
    |                                        |
    v                                        v
(routing decision)------->FORWARD------->(routing decision)--+
|                                            |               |
|                                            |               v
+->INPUT<------------------------------------+           POSTROUTING


Should this connection be here? Can a packet really get into INPUT from the right side? It can't come through FORWARD; I guess it can come from OUTPUT. If that's the case, then maybe it shouldn't pass through the same routing decision as one from FORWARD. Should it look more like this? Oh, I just noticed. Does it really go through *two* routing decisions if it's in the FORWARD path? maybe that second one shouldn't be there.

(routing decision)------->FORWARD------->(routing decision)--------------+
      |                                                                  |
      |                                                                  |
      v                                                                  v
    INPUT<--------------------(routing decision)------------------->POSTROUTING
      |                              ^                                   |
      |                              |                                   |
      |                              |                                   |
      |                            OUTPUT                                |
      |                              ^                                   |
      v                              |                                   v
Local Process x              Local Process y                         Outgoing

The second question is ----->  what is the effect of a rule like this:

iptables -A OUTPUT -out-interface eth0 blah blah blah

How can it know what the output interface is going to be before it's been through the routing decision? Have I got OUTPUT and its routing decision in the wrong order? I guess in that case I'd still need the branch point between INPUT and POSTROUTING. Is it maybe the case that "routing decision" and "branch in this diagram based on a routing decision" are separate concepts? This is complex!!

Thanks, guys, I'm not a kernel hacker.

Jimmy Wilkinson            | Perfesser of Computer Science
jimmy@cs.CofC.edu          | The College of Charleston
(843) 953-8160             | Charleston      SC        29424

If there is one word to describe me,
that word would have to be "profectionist".
Any form of incompitence is an athema to me.
Metathesis??? Don't ax me.

Reply to: