target ACCEPT in maccheck chain, forward chain is still used?

hi,

I'm configuring a machine with iptables to serve as "router" and I have a rather strange question.

I have to do mac check on one of the networks the router is connected so I have something like this:
iptables -t mangle -N maccheck
iptables -t mangle -I PREROUTING -i eth1 -j maccheck
iptables -t mangle -A maccheck -m mac -j ACCEPT --mac-source AA:BB:CC...etc iptables -t mangle -A maccheck -j DROP

(this is not pasted so ignore the typos)

I also have many rules in FORWARD chain.

My question is simple: what happens to the packet when it's marked as ACCEPT by the 3rd rule? The rules that apply to that packet in the FORWARD chain are still used or the ACCEPT stuff just overrides everything?

My tests say the FORWARD RULES are still used, am i correct?

(this is kind of a discussion with a mate, so if you can add documentation to prove it, i will appreciate it...)

Many thx in advance

Correct. If a packet is ACCEPTed (which may be implicit by falling of a chain, in that case the chains policy is applied), processing continues with the next chain. Otherwise processing stops.

So if your PREROUTING chain has a policy of ACCEPT (which it should, check with iptables-save command), explicitly ACCEPTing a packet is no different from falling of the chain. In that last case you already know the rest of the chains are applied (think of an empty chain), so it is easy to see that any ACCEPT means to continue with the next chain.

HTH,
M4