[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: ipchains style



On Mon, 1 Jan 2001, Adi Stav wrote:

> > btw, in the new kernel (2.4), where netfilter is used, there is a new
> > notion of tables. unlike usage of multiple chains, usage of multiple
> > tables does add extra functionality, in that itallows you to have one set
> > of rules perform a complete "computation", and then the packets coming out
> > of it are re-processed by the rules in a second table. i already so a case
> > where this allowed for more functionality then s possible using kernel
> > 2.2's chains.
>
> Hmm. How is that different from from creating custom chains in
> ipchains and sending packets from one chain to another?

very different. when using chains, when one of the chains had a rule that
matched a packet, no further processing of that rule by _any_ of the rules
in any of the chains is checked any more. thus, you cannot re-process a
packet that was processed by one of your rules, and thus cannot apply two
modifications to the same packet (the exception is that FORWARDED packets
also used to pass via the 'output' chain, but then you cannot know if
you're pos-tprocessing a forwarded packer, or processing a locally
generated packet.

with the tables, after a packet has been processed by the chains of the
first table, the new (possibly modified) packet is now processed by the
chains of the second table.

--
guy

"For world domination - press 1,
 or dial 0, and please hold, for the creator." -- nob o. dy


=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il