1

From some reading I did as a newcomer, I understand that the term iptables isn't really that straight forward as it sounds ("a list of ip addresses"), and may resemble at least 3 different things in the Linux discourse:

  1. The iptables Linux kernel module made of an information system in the form of context-based tables which acts as logical basis for another Linux kernel module - The Linux firewall.

  2. A Linux utility also called iptables that comes virtually in any distro, and uses a sysadmin to manipulate the kernel module called iptables (section 1) by commands, "from outside" (instead by text editing, "from inside").

  3. A potential set of tables (or a single table) inside the iptables kernel module, dealing with allowed or blocked IP addresses.

I am new to Linux and can't tell how exactly was I accurate here; My question is if this is accurate and if there aren't any more "semantic" names for these types of software.

Edit: It was also unclear to me if it is right to explain "iptables chain" just a "special type of rules" or as "a particular iptables command dealing with all cells in a row". I did saw we can change a row in a "chained" command, like iptables [-arguments] [value per column].

Improve this question
4

It's (1) and (2), and as they are closely related (the latter being an interface to the former), this is not really a reason for confusion.

And it's a set of rules for handling IP packets, and the rules happen to be arranged in tables, so "list of ip addresses" makes no sense at all. The previous implementation was called ipchains, because the rules were arranged in a chain, so the name of the new implementation emphasized that there are now several tables of chains.

Improve this answer
4
  • Upvoted, but you might still want to point out some misunderstandings and weirdneses in the OP's exposition of (1) and (2). It's unclear how a text file could be communicated from user space to kernel space if there wasn't a command which did this, for example. – tripleee Apr 14 '17 at 7:54
  • Also, there isn't really any ambiguity here; the iptables system is a single thing, and if you want to talk about just the kernel module component or just the command-line tool, you use phrases like this if it's not otherwise clear from the context. – tripleee Apr 14 '17 at 7:58
  • Is an "iptables chain" just a "special type of rules" or is it "all cells in a row". That wasn't clear to me as a newcomer, when I saw we can change a row in a "chained" command. – user149572 Apr 15 '17 at 1:57
  • I very much enjoyed your explanation. I also had a question regarding iptables which I was wondering if you might know the reasoning behind: unix.stackexchange.com/questions/359884/… – Webeng Apr 19 '17 at 8:02
0

Is an "iptables chain" just a "special type of rules" or is it "all cells in a row"?

iptables contain a number of chains. By default, there are 3 chains, INPUT, OUTPUT and FORWARD. You can also add your own custom chains. Each chain consists of zero or more rules. Rules are evaluated in the order they appear in a chain. You can add, modify, move or delete rules in a chain. Rules consist of a pattern and an action. Chains have a default action also.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy