iptables question

sang_froid · 10-08-2009, 09:15 AM

Hi,

In the following rule, what does -m option do ? Why do we need it ?

-A INPUT -s 192.168.1.1 -p tcp -m tcp --dport 22 -j ACCEPT

I am not getting if "-m tcp" is really needed or not and its use ...

Thank you

kirukan · 10-08-2009, 09:32 AM

its match whether it is tcp or udp packet,its not only for tcp & udp packet matching just check the man page there are examples about matching

sang_froid · 10-08-2009, 09:38 AM

-p tcp already does that job.... doesn't it ?

in that case, why do we still need -m option ?

Quote:

Originally Posted by kirukan

its match whether it is tcp or udp packet

zhjim · 10-08-2009, 10:31 AM

Quote:

Originally Posted by sang_froid

-p tcp already does that job.... doesn't it ?

in that case, why do we still need -m option ?

You don't need the -m option. -p implicitly loads the tcp module. Heres the extract from the manual

Code:

MATCH EXTENSIONS
       iptables can use extended packet matching modules.  These are loaded in two ways: implicitly, when -p or --protocol is specified, or with  the  -m
       or  --match options, followed by the matching module name; after these, various extra command line options become available, depending on the speâ
       cific module.  You can specify multiple extended match modules in one line, and you can use the -h or --help options after  the  module  has  been
       specified to receive help specific to that module.

Just my opinion matching is a bad wording I'd rather say module but who cares.

win32sux · 10-08-2009, 10:51 AM

You don't need it when executing an iptables command (since the match module gets auto-loaded), but is anyone positive it's not needed in the actual configuration file? I don't ever edit that file manually (only with iptables-save) so I'm not sure.

zhjim · 10-09-2009, 03:17 AM

Quote:

Originally Posted by win32sux

You don't need it when executing an iptables command (since the match module gets auto-loaded), but is anyone positive it's not needed in the actual configuration file? I don't ever edit that file manually (only with iptables-save) so I'm not sure.

Your absolute right win32sux. When adding the rule by hand -m tcp is not needed but when saving iptables rules its always added.
Did a trial run adding the iptables rule once with and once without -m tcp and iptables-save always prints the line with -m tcp

Empty iptables

Code:

# iptables-save
# Generated by iptables-save v1.4.2 on Fri Oct  9 10:09:12 2009
*filter
:INPUT ACCEPT [84697:13964056]
:FORWARD ACCEPT [90216:12884867]
:OUTPUT ACCEPT [29225:6783683]
COMMIT
# Completed on Fri Oct  9 10:09:12 2009

Now add the line with -m tcp option

Code:

# iptables -A INPUT -s 192.168.1.1 -p tcp -m tcp --dport 22 -j ACCEPT
# iptables-save
# Generated by iptables-save v1.4.2 on Fri Oct  9 10:09:38 2009
*filter
:INPUT ACCEPT [84787:13973745]
:FORWARD ACCEPT [90248:12890096]
:OUTPUT ACCEPT [29282:6790635]
-A INPUT -s 192.168.1.1/32 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT
# Completed on Fri Oct  9 10:09:38 2009

Now add the line without

Code:

# iptables -A INPUT -s 192.168.1.1 -p tcp --dport 22 -j ACCEPT
Producer:/home/ase# iptables-save
# Generated by iptables-save v1.4.2 on Fri Oct  9 10:10:12 2009
*filter
:INPUT ACCEPT [84877:13985121]
:FORWARD ACCEPT [90282:12897348]
:OUTPUT ACCEPT [29334:6796807]
-A INPUT -s 192.168.1.1/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 192.168.1.1/32 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT
# Completed on Fri Oct  9 10:10:12 2009

Both times its written with the -m tcp option