My iptables -nvL looks like this:
bash# iptables -nvL
Chain INPUT (policy ACCEPT 1031 packets, 81085 bytes)
pkts bytes target prot opt in out source destination
11111 951K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP tcp -- ppp0 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:135:139
0 0 DROP udp -- ppp0 * 0.0.0.0/0 0.0.0.0/0 udp dpts:135:139
0 0 DROP all -- ppp0 * 0.0.0.0 0.0.0.0/0
0 0 DROP udp -- ppp0 * 0.0.0.0/0 0.0.0.0/0 udp dpts:67:68
0 0 DROP all -- ppp0 * 255.255.255.255 0.0.0.0/0
0 0 DROP tcp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 ACCEPT all -- ppp0 * 10.0.0.0/8 0.0.0.0/0 state NEW,ESTABLISHED
Why does it say DROP all ppp0 before ACCEPT all ppp0 [ip]?
Doesn't the INPUT chain stop before coming to the second rule (i.e. stop att DROP all ppp0)?
Could it be that someone would like to keep the rules but just block temporarily? Or does the rule matching continue through the chain even after it's got a match? As I understand it, the chain traversing stops directly when a criteria is met, or have I misunderstood this?