Where does RH-Firewall-1-INPUT fall into the scheme of things with IPTables

JockVSJock · 06-18-2015, 09:26 AM

For RHEL IPTables, I'm trying to understand how RH-Firewall-1-INPUT works with the other chains of input, output and forward.

Found some info online that it is a user-defined custom chain that is used by input, output and forward chains, however that was vague and I'm not sure how it really works with the other chains in IPTables.

Was wondering if others had insight or could point me in the right direction.

thanks

lazydog · 06-18-2015, 12:14 PM

This is a STUPID thing Rh done trying to be cleaver. I wipe their setting every-time and recreate the rules as I see fit.

chrism01 · 06-19-2015, 05:18 AM

The key phrase is

Quote:

user-defined custom chain

You can add your own chains and jump to them from the std chains when a given condition is matched.

HTH

JockVSJock · 06-19-2015, 05:43 AM

Quote:

Originally Posted by chrism01

The key phrase is

You can add your own chains and jump to them from the std chains when a given condition is matched.

HTH

I'm not clear on how adding in your own custom rules for say INPUT and OUTPUT differs from RH-Fireall 1 INPUT.

Do you have an example where it jumps from INPUT/OUTPUT to RH-Firewall 1 INPUT?

JockVSJock · 06-19-2015, 05:50 AM

Found the following example online:

Code:

-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT

I'm new to IPTables, so it seems odd to jump from one rule to another rule.

Also, it seems as of RHEL v6, this is dropped.

lazydog · 06-19-2015, 11:19 AM

These are chains that are not needed. As stated before RH was trying to be cleaver. Anything in RH-FIREWALL-1-INPUT can be moved to INPUT chain without issues. Same for RH-FORWARD-1-INPUT can be moved to FORWARD chain.

They dropped this in v6 because behind closed doors they realized it was stupid too.

Wait until you jump to v7 where they use a totally different firewall. Now you are going to have fun. But you can disable this one too and install iptables, as I have done.