iptables modules description
Hi all,
I am looking for a description of the iptables modules (e.g. nf_conntrack_ftp) that can be loaded when iptables starts: IPTABLES_MODULES directive in /etc/sysconfig/iptables-config I have been trying to search google for this for hours with no luck. I would really appreciate if someone could direct me to where I can find this information. Regards |
Probably isn't a list as it isn't needed, the info is right there if you know what the shortened names mean.
nf_conntrack_ftp nf - netfilter conntrack - connection tracker ftp - the protocol this is for You can also dump the info from the modules themselves with this :- Code:
cd /lib/modules/$(uname -r)/kernel/net/netfilter/ |
this is really useful.. thanks a lot!
one more thing.. in the iptables config file it says that by default no modules are loaded unless specified in the directive.. however connection tracking does work without adding nf_conntrack in there.. are there some modules that are loaded by default? and if yes, how can we find out which ones these are? cheers! |
2 points there
1 iptables does not have a config file, so whatever your looking at is distro specific 2 kernel module loading allows you to load a module that depends on other not yet loaded modules by on-demand loading of the other modules so "modprobe nf_conntrack_ftp" will also pull in "nf_conntrack" |
so is there a way to find out which modules loads which other modules?
when i run an lsmod I get the following: [root@rhce log]# lsmod | grep nf nf_nat_ftp 3473 0 nf_conntrack_ftp 12911 1 nf_nat_ftp nf_nat 22788 3 nf_nat_ftp,ipt_MASQUERADE,iptable_nat nf_conntrack_ipv4 9440 6 iptable_nat,nf_nat nf_defrag_ipv4 1449 1 nf_conntrack_ipv4 nf_conntrack_ipv6 19655 2 nf_conntrack 79643 8 nf_nat_ftp,nf_conntrack_ftp,ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4,nf_conntrack_ipv6,xt _state ipv6 321209 30 ip6t_REJECT,nf_conntrack_ipv6 I would expect this means that nf_conntrack loads nf_conntrack_ftp as well, but when I put nf_conntrack only in the iptables-config file the ftp inspection does not work (ls from remote ftp session). Only when I put nf_conntrack_ftp in the iptables-config file than ftp inspection works. Any comments on that? |
Quote:
The modules on the right depend on the ones on the left, the column header kinda gives a hint. |
All times are GMT -5. The time now is 04:47 AM. |