Iptables match query policy

Iptables matchTo onePolicyThen, we will not continue searching for the policy. Let's see why.

That is to say, when a packet arrives at the nic and iptables checks, it is checked one by one according to the rules set in/etc/sysconfig/iptables. Therefore, setting the previous rule will affect the subsequent rule. Be careful when setting the rule. For example:

# Generated by iptables-save v1.2.8 on Sun Nov 25 16:13:01 2007

* Filter

: Input drop [0: 0]

: Forward accept [0: 0]

: Output accept [0: 0]

-A input-I eth1-p tcp-m tcp -- tcp-flags SYN, RST, ACK SYN-j DROP

-A input-I lo-j ACCEPT

-A input-I eth1-p tcp-m tcp -- dport 22-j ACCEPT

-A input-I eth1-p tcp-m tcp -- dport 53-j ACCEPT

-A input-I eth1-p udp-m udp -- dport 53-j ACCEPT

-A input-I eth1-p tcp-m tcp -- dport 139-j ACCEPT

-A input-m state -- state ESTABLISHED-j ACCEPT

-A output-o lo-j ACCEPT

-A output-p tcp-m tcp -- sport 22-j ACCEPT

-A output-p tcp-m tcp -- sport 53-j ACCEPT

-A output-p udp-m udp -- sport 53-j ACCEPT

-A output-p tcp-m tcp -- sport 139-j ACCEPT

COMMIT

# Completed on Sun Nov 25 16:13:01 2007

Such a rule does not have any effect after it is set. Because at the beginning:

-A input-I eth1-p tcp-m tcp -- tcp-flags SYN, RST, ACK SYN-j DROP

In this statement, all the possible network links sent to eth1 are closed. Therefore, the open port 22 below will all be invalid, because iptables will not go further. So be careful.

Through the above, we all know why iptables won't continue searching for the policy after it matches a policy! I hope this article will be useful to you!