netfilter seems to allow rejected traffic from my
INPUT chain to go through my
OUTPUT chain. Here are the rules from the
INPUT chain that are applied to the packets in question:
LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix "ICATCH:" REJECT-PKT all -- * * 0.0.0.0/0 0.0.0.0/0
REJECT-PKT chain and its relevant rule:
REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp reject-with tcp-reset
Here's the logged result:
May 15 06:41:51 li51-144 kernel: ICATCH:IN=eth0 OUT= MAC=f2:3c:91:1f:61:44:84:78:ac:0d:97:c1:08:00 SRC=188.8.131.52 DST=<my IP> LEN=40 TOS=0x00 PREC=0x00 TTL=46 ID=46841 PROTO=TCP SPT=8838 DPT=23 WINDOW=22014 RES=0x00 SYN URGP=0 May 15 06:41:51 li51-144 kernel: OCATCH:IN= OUT=eth0 SRC=<my IP> DST=184.108.40.206 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=23 DPT=8838 WINDOW=0 RES=0x00 ACK RST URGP=0
The second line is produced by the following (penultimate) rule in the
LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix "OCATCH:"
I was under the impression that rejected packets were somehow marked by the kernel, and that TCP traffic with an
RST flag that resulted from
iptables rules was not processed by the firewall.
What have I misunderstood?