Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other benefit?

share|improve this question

migrated from serverfault.com Dec 21 '11 at 19:35

This question came from our site for professional system and network administrators.

1  
I'm not sure if the question was understood the way I intended to ;) Basically, I wanted to know, why tables, such as raw, mangle, nat, filter were added to ipchains. The examples that Chris S and cjc provided explain very well, how one can use user-defined chains with iptables (I've actually learned new things thanks to their posts). From what I've read so far, user-defined chains are not tables. Maybe I should create a new question about iptables tables. Of course I may be wrong as I'm new to the iptables topic. –  colemik Dec 21 '11 at 21:50
1  
I don't understand the question, with or without your comment. The built-in tables control various aspects of how packets are handled; this chart (courtesy of artistoex) shows how they're used. This isn't a matter of performance, it's part of what iptables is meant to control. –  Gilles Dec 22 '11 at 0:34
    
I've asked the question to understand, what are iptables tables in relation to iptables chains. Are tables sets of chains or are tables some other entities that share common features with chains? If tables are sets of chains, why it looks like there are 4 tables in the OUTPUT chain on this diagram: link. –  colemik Dec 22 '11 at 0:45
1  
I've asked the question to understand, what are iptables tables in relation to iptables chains. Are tables sets of chains or are tables some other entities that share common features with chains? If tables are sets of chains, why it looks like there are 4 tables in one chain on this diagram: link. From what I've read so far, the tables are in deed sets of chains. So, to narrow down the q, what benefits iptables gets from implementing tables? What would happen if the tables weren't implemented?Hv sth to do wth ipt modules? –  colemik Dec 22 '11 at 0:54
    
Good question. "Tables" appear prominently in the user docs, but it's not clear how they matter and why a user would need to know. In fact, packets travel through chains, but the order in which these chains are linked does not correspond to those "tables"; if that were the case, all chains in one table (say, mangle) would have to come first, then all in the next one, and so on. - It seems to be all about chains; tables seem to serve no clear purpose. Are they an implementation detail leaked to user docs? Is that because the predecessor was called ipchains and there had to be a difference? –  Lumi Nov 29 '12 at 9:13
add comment

2 Answers 2

iptables -N dmzrules
iptables -A dmzrules -p TCP --dport 22  -j ACCEPT
iptables -A dmzrules -p TCP --dport 80  -j ACCEPT
iptables -A dmzrules -p TCP --dport 443 -j ACCEPT
iptables -A dmzrules -p UDP --dport 53  -j ACCEPT
iptables -A dmzrules -p UDP --dport 123 -j ACCEPT


iptables -A FORWARD -s 10.0.91.0/24    -j dmzrules
iptables -A FORWARD -s 192.168.22.0/24 -j dmzrules
iptables -A FORWARD -s 172.16.33.0/24  -j dmzrules

So, in the above example, you don't have to write rules for the same set of allowed UDP/TCP ports over and over again for the allowed networks. So, you have 9 lines instead of 15. There should be some performance improvement since each incoming packet doesn't have to try matching on 15 rules. Instead, a packet will be matched those 3 INPUT rules, and if there's a match on the source IP, it will try matching on the 4 rules in the dmzrules table.

I think if you're using iptables for a single box, it may be less useful to use tables. You can probably just enumerate the allowed ports in one swoop, though Chris's point about black/white lists is something to keep in mind, i.e., you can update this list without mucking with the main set of rules.

share|improve this answer
add comment

"tables" were included because the concept carried over to ipchains from when Linux used BSD's IPFW firewall. They make it easy to apply one or more rules to a set of IPs that should administratively be treated the same.

The most common place I see them is when using black or white lists. You might be using fail2ban to automatically block IPs that are "attacking" your server, adding them to a naughty table instead of creating a rule for each IP keeps things clean. Similarly you might have a set of "administrative" machines on your network with diverse IPs, you could add those to a table then write a single rule that allows them to SSH into your server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.