Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm going through the iptables tutorial and am currently at Chapter 6, Traversing of tables and chains.

I'm having trouble understanding the why's behind Tables 6-1, 6-2, and 6-3 listed in the above chapter.

Questions:

  1. Is there a better book or online resource where a better explanation can be found?

  2. Am I supposed to rote-learn / memorize the various steps covered in these tables?

  3. The above tutorial appears to be many years old. Is everything said of iptables in there still 100% valid. The iptables version that I have on my system is 1.4.14.

All these questions are arising mainly because I so far 'feel' that, maybe, all that iptables should have done was provided us with a bare minimum set of hook-points (like, e.g. pre- and post-routing hooks), and an ability to do arbitrary packet processing (in any sequence that we deemed fit and any number of times - a custom state machine) instead of stipulating the detailed sequence of steps as in the above Tables. For example, in the diagram that follows Table 6-3, why should the 'filter input' step come only after 'mangle input', and not before? And, why not both before and after? Etc.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Is there a better book or online resource?

Possibly? Probably? There are a ton of online and off-line resources to learning Linux and iptables. The Wiki has a nice overview. Here's another usage and admin guide. Here's another guide with the same information as FrozenTux, but rewritten slightly.

Am I supposed to rote-learn / memorize the various steps

That depends. Why are you studying in the first place?

Do you need to memorize everything in order to use iptables? No. The filter is defaulted if you don't define any other table. Would it be helpful if you want to leverage iptables to its full extent? Absolutely.

Still valid?

Yes.

why should the 'filter input' step come only after 'mangle input', and not before? And, why not both before and after?

The key is the description in table 6.1, lines 8 and 9. In essence, you want to make decisions on alterating (aka mangling) the packet prior to actually filtering the packet.

That's why the mangle input chain is hit first and then the filter input chain.

Similarly, the sequence of steps is important because the packet is incoming to the machine (that is running iptables). You can't make "input" or incoming decisions on a packet after it's already been routed and is now outgoing.

You'll notice that table 6.3 is NOT a continuation of table 6.2 Instead, they are similar up to line 7 (routing decision) and then line 8 is a different path or fork. Table 6.2 is for packets within the same network. Table 6.3 is for packets off network.

It's important to remember the 7 layer OSI model. Every bit of data is packaged and repackaged into various segments, packets, and frames. Every network "hop" is another opportunity for any particular segment, packet, or frame to be manipulated and rewritten.

iptables gives very granular control over that repackaging. You can write rules on incoming packets, outgoing packets, packets just for your network and not others or vice versa, your device, not your device, etc. And you can alter various headers for all of those frames. **

** I'm aware I freely intermingle "frame", "segment", and "packet". Sorry, I really shouldn't. Unless I'm trying to make a point or doing specific network analysis, I always do that.

share|improve this answer
    
"Why are you studying in the first place?" I'm trying to understand and master every aspect of iptables, what all it can do. I have seen many snippets online for opening/blocking ports, NAT'ing, etc so wanted to learn the whole thing. Appreciate your response, especially two of the references you mentioned; the third one happens to be an older version of what I'm already reading. –  Harry Sep 26 '12 at 9:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.