Why were tables built into ipchains?

Question

Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other benefit?

Answer 1

"tables" were included because the concept carried over to ipchains from when Linux used BSD's IPFW firewall. They make it easy to apply one or more rules to a set of IPs that should administratively be treated the same.

The most common place I see them is when using black or white lists. You might be using fail2ban to automatically block IPs that are "attacking" your server, adding them to a naughty table instead of creating a rule for each IP keeps things clean. Similarly you might have a set of "administrative" machines on your network with diverse IPs, you could add those to a table then write a single rule that allows them to SSH into your server.

Answer 2

iptables -N dmzrules
iptables -A dmzrules -p TCP --dport 22  -j ACCEPT
iptables -A dmzrules -p TCP --dport 80  -j ACCEPT
iptables -A dmzrules -p TCP --dport 443 -j ACCEPT
iptables -A dmzrules -p UDP --dport 53  -j ACCEPT
iptables -A dmzrules -p UDP --dport 123 -j ACCEPT


iptables -A FORWARD -s 10.0.91.0/24    -j dmzrules
iptables -A FORWARD -s 192.168.22.0/24 -j dmzrules
iptables -A FORWARD -s 172.16.33.0/24  -j dmzrules

So, in the above example, you don't have to write rules for the same set of allowed UDP/TCP ports over and over again for the allowed networks. So, you have 9 lines instead of 15. There should be some performance improvement since each incoming packet doesn't have to try matching on 15 rules. Instead, a packet will be matched those 3 INPUT rules, and if there's a match on the source IP, it will try matching on the 4 rules in the dmzrules table.

I think if you're using iptables for a single box, it may be less useful to use tables. You can probably just enumerate the allowed ports in one swoop, though Chris's point about black/white lists is something to keep in mind, i.e., you can update this list without mucking with the main set of rules.