Hi all,

I'm having the following scenario:
- multiple custom chains;
- multiple default chains rules that points to those custom chains;

Below is an example:

Chain INPUT (policy ACCEPT)
num pkts bytes target prot opt in out source destination
1 0 0 DanM_test1 all -- eth2 * 0.0.0.0/0 0.0.0.0/0
2 0 0 DanM_test1 all -- lo * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num pkts bytes target prot opt in out source destination
1 0 0 DanM_test2 all -- vlan350 * 0.0.0.0/0 0.0.0.0/0
2 0 0 DanM_test2 all -- * vlan350 0.0.0.0/0 0.0.0.0/0
3 0 0 DanM_test2 all -- * lo 0.0.0.0/0 0.0.0.0/0
4 0 0 DanM_test3 all -- eth2 eth1 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num pkts bytes target prot opt in out source destination

Chain DanM_test1 (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- eth2 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 0 0 REJECT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 reject-with icmp-port-unreachable
3 0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
4 0 0 ACCEPT tcp -- * eth2 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
5 0 0 REJECT tcp -- * lo 0.0.0.0/0 0.0.0.0/0 tcp dpt:23 reject-with icmp-port-unreachable


Chain DanM_test2 (3 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- vlan350 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22

Chain DanM_test3 (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 0 0 ACCEPT tcp -- eth0 vlan350 0.0.0.0/0 0.0.0.0/0 tcp dpt:22

My question/questions is/are related if I can configure multiple interfaces for one rule, custom chain or default chains?

For example in custom-chain rules:

sudo iptables -A DanM_test1 -i eth1,eth2 -o eth3,eth4 -j ACCEPT -> eth1 eth2, eth3, eth4 are all different interfaces

After adding this line my iptables rules look as bellow:

Chain DanM_test1 (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- eth2 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 0 0 REJECT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 reject-with icmp-port-unreachable
3 0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
4 0 0 ACCEPT tcp -- * eth2 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
5 0 0 REJECT tcp -- * lo 0.0.0.0/0 0.0.0.0/0 tcp dpt:23 reject-with icmp-port-unreachable
6 0 0 ACCEPT all -- eth1,eth2 eth3,eth4 0.0.0.0/0 0.0.0.0/0

Example for default INPUT/FORWARD chains:

sudo iptables -A FORWARD -i eth1, vlan350 -o eth3, vlan351 -j DanM_test1 -> eth1, vlan350, eth3, vlan351 are different interfaces

I'm receiving:
Bad argument `vlan350'
Try `iptables -h' or 'iptables --help' for more information.

Thank you,
Dan

I'm not the world's expert on this by any means, but at 555 views and no answers, let me call it.


It's not good to do as you suggest. Stick to 1 interface, one address range, one instruction. Read the configuration man page, e.g. 'man iptables.conf' or download internet examples. Test your results by connecting your nic to another pc, giving it a static ip of your choice, and sending packets.

The resulting config will also be easier to read, and edit. Group things intelligently. If it's firewall rules, you can rest assured you will be back, and it's good to at least start with an easy-to-read file.

I (not the world's expert on this by any means) also thought the standard order was
allow this
allow that
allow the other
deny all

which ensures that everything you haven't thought of gets blocked. I'd really suggest you read some more, and get a feel for it yourself.

1 members found this post helpful.

It's sometimes better to specify a drop before and after the accept (if they are added to chain, if they are injected to chain that's a different story).
Mine have always looked something like this:

- many multiport, iprange, and protocol drops.
- couple of wide range statefull accepts
- drop all

And for the OP: may be possible but never really looked into it, personally I just specify separate rules for each interface.

1 members found this post helpful.

Yes.

1 members found this post helpful.

Assuming you copy-pasted the exact command I think the specific issue here causing the error message is that your interfaces aren't comma separated, they are separated by comma and space. So iptables sees vlan350 as a separate argument and hence reports bad argument.

As for specifying multiple interfaces in one go, I don't see a problem.

1 members found this post helpful.

Thank you so much for your responses, we solved the problem , is a hard scenario indeed and we figure out what was needed for our scenario.