Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packetsīefore routing) and OUTPUT (for altering locally-generated packets before routing). This table is used for specialized packet alteration. It consists of three built-ins: PREROUTING (for altering packetsĪs soon as they come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about This table is consulted when a packet that creates a new connection is encountered.
(for packets being routed through the box), and OUTPUT (for locally-generated packets). It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD This is the default table (if no -t option is passed). Will be made to load the appropriate module for that table if it is not already there. If the kernel is configured with automatic module loading, an attempt t, -table table This option specifies the packet matching table which the command should operate on. There are currently three independent tables (which tables are present at any time depends on the kernel configuration options and which modules are Matched, the target specified by the chain policy determines the fate of the packet. If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is
Resume at the next rule in the previous (calling) chain. Please also see the NFQUEUE target as described later in this man page.) RETURN means stop traversing this chain and Packets with a target of QUEUE will be sent to queue Kernels 2.6.14 and later additionally include the nfnetlink_queue queue handler. 2.4.x and 2.6.x kernels up to 2.6.13 include the ip_queue The packet can be received by a userspace process differs by the particular queue handler. QUEUE means to pass the packet to userspace. DROP means to drop the packet on the floor. Then the next rule is specified by the value of the target, which can be the name of a user-defined chain or one of the special values ACCEPT,ĪCCEPT means to let the packet through. If the packet does not match, the next rule in the chain is the examined if it does match, May be a jump to a user-defined chain in the same table.Ī firewall rule specifies criteria for a packet, and a target. Each rule specifies what to do with a packet that matches. Several different tables may be defined.Įach table contains a number of built-in chains and may also contain user-defined chains.Įach chain is a list of rules which can match a set of packets. Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Iptables -E old-chain-name new-chain-name Iptables -R chain rulenum rule-specification
0 kommentar(er)
