Shouldn't this rule catch all packets
I was trying to debug some errors in my iptables setup so I added the following rules to my OUTPUT, just to see what packets were going out.
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -j ACCEPT
When I do iptables -L OUTPUT -v it shows some packets are falling through to the last rule. Shouldn't the first rule catch all the packets?
Jeff
Quoted 10 lines · jwlargent
I was trying to debug some errors in my iptables setup so I added the following rules to my OUTPUT, just to see what packets were going out.
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -j ACCEPT
When I do iptables -L OUTPUT -v it shows some packets are falling through to the last rule.
Shouldn't the first rule catch all the packets?
No. There exists forth state called INVALID. E.g. TCP packet with ACK witch is not part of any tracked TCP connection is INVALID. Naturally, INVALID packets are ill packets and they shoudn't appear, but the reality is different.
-- Petr
Quoted 11 lines · Petr Pisar
Quoted 9 lines · jwlargent
I was trying to debug some errors in my iptables setup so I added the following rules to my OUTPUT, just to see what packets were going out.
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -j ACCEPT
When I do iptables -L OUTPUT -v it shows some packets are falling through to the last rule. Shouldn't the first rule catch all the packets?
Quoted 8 lines
No. There exists forth state called INVALID. E.g. TCP packet with ACK witch is not part of any tracked TCP connection is INVALID. Naturally, INVALID packets are ill packets and they shoudn't appear, but the reality is different.
-- Petr
So I put in a log rule for --state INVALID and sure enough thats what it was. The packets are part of my ssh connection, tcp with ACK.
IN= OUT=eth0 SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=276 TOS=0x10 PREC=0x00 TTL=64 ID=1146 DF PROTO=TCP SPT=22 DPT=38858 WINDOW=3228 RES=0x00 ACK PSH URGP=0