LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
LinkBack Search this Thread
Old 04-05-2007, 10:18 PM   #1
kurrupt
Member
 
Registered: Jul 2004
Distribution: Debian, Ubuntu, FreeBSD, RHEL
Posts: 202

Rep: Reputation: 31
Question forward, input & output chains on iptables


Hello guys, I would like to clarify the differences between the 3 default filter chains in iptables. Please correct me if iam wrong.

Input & Output chains: A packet that travels into the firewall with a local IP that is destined to another local IP on the same network; it will be passed to the INPUT chain then to the OUTPUT chain out of the same interface. LOCAL ONLY!

Forward chain: A packet that has to be passed from 1 interface to another. Eg: eth0 to eth1. Can be local or for the internet (nat).


am i right? heh

Thanks
 
Old 04-05-2007, 11:32 PM   #2
sparc86
Member
 
Registered: Jul 2006
Location: Nuremberg, Germany
Distribution: Debian, Gentoo
Posts: 294
Blog Entries: 1

Rep: Reputation: 31
Quote:
Originally Posted by kurrupt
Hello guys, I would like to clarify the differences between the 3 default filter chains in iptables. Please correct me if iam wrong.

Input & Output chains: A packet that travels into the firewall with a local IP that is destined to another local IP on the same network; it will be passed to the INPUT chain then to the OUTPUT chain out of the same interface. LOCAL ONLY!

Forward chain: A packet that has to be passed from 1 interface to another. Eg: eth0 to eth1. Can be local or for the internet (nat).


am i right? heh

Thanks


Yes, that's it. But if you want to get a better understanding about iptables, I suggest you to check this tutorial:


http://iptables-tutorial.frozentux.n...-tutorial.html
 
Old 11-09-2011, 04:09 AM   #3
fhleung
Member
 
Registered: Aug 2004
Distribution: Fedora, Debian
Posts: 313

Rep: Reputation: 30
Apart from INPUT, OUTPUT, FORWARD chains, there are also POSTROUTING and PREROUTING.
All these chains are in the -t nat filter raw mangle tables.
 
Old 11-09-2011, 04:27 AM   #4
fukawi1
Member
 
Registered: Apr 2009
Location: Melbourne
Distribution: Fedora & CentOS
Posts: 854

Rep: Reputation: 189Reputation: 189
edit: double post

Last edited by fukawi1; 11-09-2011 at 04:29 AM.
 
Old 11-09-2011, 04:29 AM   #5
fukawi1
Member
 
Registered: Apr 2009
Location: Melbourne
Distribution: Fedora & CentOS
Posts: 854

Rep: Reputation: 189Reputation: 189
Quote:
A packet that travels into the firewall with a local IP that is destined to another local IP on the same network; it will be passed to the INPUT chain then to the OUTPUT chain out of the same interface. LOCAL ONLY!
Not quiet. A packet destined for the host itself, not for another IP on the same network. That would go through the forward chain.

Imagine a local DNS server.
Client (10.0.0.2) sends a request to firewalled DNS server (10.0.0.1)
the packet will traverse the input chain, be processed by bind, and then the reply would traverse the output chain on its way back to the client (10.0.0.2)

Where as
If the client and server were both attached to a switch.
And client1 (10.0.0.2) sends a packet to client2 (10.0.0.3) the switch will send the packets to the relevant physical port that 10.0.0.3 is attached to, and the packet doesn't get seen by the firewall.

filter/INPUT - is for packets destined FOR the host
filter/OUTPUT - is for packets destined FROM the host
filter/FORWARD - is for packets passing THROUGH the host.

http://www.linuxhomenetworking.com/w...t_Flow_Diagram has a flowchart showing the packet flow through the iptables chains.

It is also a good read and gives a good foundation in iptables.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
creation of new iptables chains !!!! gabsik Linux - Security 6 05-25-2006 06:57 PM
How to delete the one of iptables chains? 80mail Linux - Networking 1 12-21-2005 02:16 AM
Output & input redirection serotonincy Programming 3 04-12-2004 08:28 AM
iptables FLOOD FLAGS and INVALID chains - need another module? MadCactus Linux - Security 3 11-19-2003 08:26 AM
how packets traverse thru iptables chains? hardigunawan Linux - Security 1 01-09-2003 01:50 AM


All times are GMT -5. The time now is 02:57 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration