/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ Good day, Rajiv, On Wed, 3 Nov 1999, Rajiv Ghai wrote: (The concepts discussed below are equally valid for any packet filtering firewall, including ipfw, ipfwadm, ipchains, and netfilter/iptables on Linux, Cisco IOS access-lists, Border Manager, and any other packet filering firewall; only the syntax will differ). > As another one lurking around this list for a while I wonder if Rusty could > clear up one fundamental question I have and possibly many others too. > Does it matter in what order the ipchains rules are written ? Yes. > ie. ACCEPT Rule following a DENY rule is the same as a DENY Rule followed > by an ACCEPT Rule ?. Same with FORWARD, MASQ and REDIRECT ? For any packet arriving in the system, the input chain *1 is scanned from the top down until a matching accept, reject, deny, masq, or redirect rule is found. Picture a firewall with the following two rules: ipchains -A input -s 1.2.3.4/32 -j ACCEPT ipchains -A input -i eth0 -j ACCEPT Can these rules be swapped without changing the structure of the firewall? Yes, they can; for any given packet, it doesn't matter whether it matches the first or the second rule, it will still be accepted. How about these; can these be swapped? ipchains -A input -s 1.2.3.4/32 -j ACCEPT ipchains -A input -s 4.5.6.7/32 -j DENY Yes, they can, but for a different reason. Any given packet will have a source address of 1.2.3.4 (in which case it will be accepted whether that rule comes first or second), a source address of 4.5.6.7 (in which case it will be denied whether that rule comes first or second), or some other source address (in which case some other part of the firewall will handle it). One more important example: ipchains -A input -s 1.2.3.4/32 -j ACCEPT ipchains -A input -d 4.5.6.7/32 -j DENY These two _cannot_ be swapped without changing the structure of the firewall. A packet arrives on the system with a source address of 1.2.3.4 and a destination address of 4.5.6.7. If the rules are listed as above, it will be accepted because it's source address matches the first rule. If you swap the rules, that same packet will be denied because of its destination address. When you're looking at swapping rules, here's the summary (these are presented in the same order as the examples of them above): - If two rules have the same action, they can be swapped. - If two rules have different actions and no packets could be matched by both, they can be swapped. - If two rules have different actions and there are packets that could be matched by both, they cannot be swapped without changing the way the firewall acts. In particular, swapping those rules changes what the firewall will do to the packets that match both rules from the original action to the other action. One more subtle note about the term "action" as used in this context. For the purpose of this discussio _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
