Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules:

:OUTPUT ACCEPT [123:456]
:INPUT_ZONES - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -p icmp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j OUTPUT_direct
-A INPUT_ZONES -i wlan0 -j IN_public
-A INPUT_ZONES -j IN_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -d -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
  • What does the - means in the custom chains INPUT_ZONES and INPUT_ZONES_SOURCE?
  • What happens when the rule jumps to IN_public_log?
  • Why is there no DROP policy at all?
share|improve this question

closed as too broad by Braiam, Networker, garethTheRed, slm Oct 20 '14 at 12:04

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

You show the output of iptables-save. To get the answer you'll need to show the iptables line which is generating the rule.

The rules are not jumping, they are processed line by line as they are applied. The same way as they are being read. So every IP packed is going through the rules and stops if a rule is denies it.

Why no DROP? Because none was given. Try to find the rules where they are applied. It's up to you to modify them as needed.

share|improve this answer
Can you elaborate further? This doesn't seem to answer my question at all. These are the default iptables rules set by FirewallD, a GUI application on Fedora. – Question Overflow Jan 12 '14 at 2:56
Sure. If you want to know what it means, then it has nothing in common with firewalld. You'll need to learn more about iptables. So for example you could enter iptables -L -vnx to show more verbose rules. – user55518 Jan 12 '14 at 3:19
So can you share what you know about iptables by answering what - suppose to mean in the custom chain? – Question Overflow Jan 12 '14 at 3:23
A line with - means iptables -N name, -Nmeans according to the iptbles manpage -N, --new-chain chain – user55518 Jan 12 '14 at 3:25
Ah.. I see. I suspected just as much, but couldn't find a reference that says so. And isn't it strange that there are no DROP in the default rules at all? I didn't copy the whole chunk here which is very long, but using ctrl-find, there are none in the configuration file, considering that the default is to ACCEPT. – Question Overflow Jan 12 '14 at 3:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.