[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: ipchains style




On Mon, 1 Jan 2001, Adi Stav wrote:

> Hmm. How is that different from from creating custom chains in
> ipchains and sending packets from one chain to another?

with chains - when one chain matched a rule, then its action is taken
place, and no more rule matching is performed on that packet from the
chains (there might be some strange thing regarding forwarded packet being
also processes by output rules, but then you don't distinguish between
forwarded packets and localy emitted packets).

with tables, you have two built-in tables for each of INPUT, OUTPUT and
FORWARD. after a packet was fully handled by the 1st table (the one used
for NAT in the FORWARD rules), the new (possibly modified) packet is then
processes by the second table ('filter' in the case of the FORWARD rules).

this is functionally different.

--
guy

"For world domination - press 1,
 or dial 0, and please hold, for the creator." -- nob o. dy


=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il