2

My iptables -nvL looks like this:

bash# iptables -nvL
Chain INPUT (policy ACCEPT 1031 packets, 81085 bytes)
pkts bytes target     prot opt in     out     source               destination         
11111  951K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       tcp  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:135:139 
    0     0 DROP       udp  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:135:139 
    0     0 DROP       all  --  ppp0   *       0.0.0.0              0.0.0.0/0           
    0     0 DROP       udp  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:67:68 
    0     0 DROP       all  --  ppp0   *       255.255.255.255      0.0.0.0/0           
    0     0 DROP       tcp  --  !eth0  *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
    0     0 ACCEPT     all  --  ppp0   *       10.0.0.0/8           0.0.0.0/0           state NEW,ESTABLISHED 

Why does it say DROP all ppp0 before ACCEPT all ppp0 [ip]?

Doesn't the INPUT chain stop before coming to the second rule (i.e. stop att DROP all ppp0)?

Could it be that someone would like to keep the rules but just block temporarily? Or does the rule matching continue through the chain even after it's got a match? As I understand it, the chain traversing stops directly when a criteria is met, or have I misunderstood this?

2 Answers 2

3

It turns out that 0.0.0.0 denotes an 'invalid ip address' (note /0 is missing!)
and not 'every ip address', thus the ACCEPT-rule may actually be hit on match!

0     0 DROP       all  --  ppp0   *       0.0.0.0              0.0.0.0/0
1

By my reading you are correct - that last rule will never be hit. You can verify this by doing another iptables -vnL after running for a while and seeing the bytes and packets caught by the rules - my guess is that will always be 0 and 0.

4
  • OK thx! Because I am new to iptables I just wanted someone experience to verify why one would write like this.
    – JohnyTex
    Jul 9, 2015 at 9:58
  • 1
    @JohnyTex Also, the general policy is ACCEPT so there is no need for an accept of anything at the end. Because after all the rules are done, all - anything that didn't get dropped - are accepted.
    – barlop
    Jul 9, 2015 at 9:59
  • Weird. But could it be that if you suddenly changed the policy to DROP, the ACCEPT rules would apply then do you think? For convenience I mean...
    – JohnyTex
    Jul 9, 2015 at 10:07
  • yes, if that policy was default-drop, the trailing accept would have meaning. though if it was a drop chain, it seems like the whole chain could be one or two rules. But, that last drop is suspicious. it appears to drop all TCP from any location, that doesn't come in via eth0, which would drop all TCP from the ppp0 interface, even if it is coming from 10.0.0.0, so that may make the final rule worthless regardless of the chain default action. Jul 9, 2015 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .