Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [123:456]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -p icmp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j OUTPUT_direct
-A INPUT_ZONES -i wlan0 -j IN_public
-A INPUT_ZONES -j IN_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
  • What does the - means in the custom chains INPUT_ZONES and INPUT_ZONES_SOURCE?
  • What happens when the rule jumps to IN_public_log?
  • Why is there no DROP policy at all?
share|improve this question

put on hold as too broad by Braiam, Networker, garethTheRed, slm yesterday

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

You show the output of iptables-save. To get the answer you'll need to show the iptables line which is generating the rule.

The rules are not jumping, they are processed line by line as they are applied. The same way as they are being read. So every IP packed is going through the rules and stops if a rule is denies it.

Why no DROP? Because none was given. Try to find the rules where they are applied. It's up to you to modify them as needed.

share|improve this answer
    
Can you elaborate further? This doesn't seem to answer my question at all. These are the default iptables rules set by FirewallD, a GUI application on Fedora. –  Question Overflow Jan 12 at 2:56
    
Sure. If you want to know what it means, then it has nothing in common with firewalld. You'll need to learn more about iptables. So for example you could enter iptables -L -vnx to show more verbose rules. –  user55518 Jan 12 at 3:19
    
So can you share what you know about iptables by answering what - suppose to mean in the custom chain? –  Question Overflow Jan 12 at 3:23
    
A line with - means iptables -N name, -Nmeans according to the iptbles manpage -N, --new-chain chain –  user55518 Jan 12 at 3:25
    
Ah.. I see. I suspected just as much, but couldn't find a reference that says so. And isn't it strange that there are no DROP in the default rules at all? I didn't copy the whole chunk here which is very long, but using ctrl-find, there are none in the configuration file, considering that the default is to ACCEPT. –  Question Overflow Jan 12 at 3:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.