Chapter 11. Iptables targets and jumps
The target/jumps tells the rule what to do with a packet that is a perfect
match with the match section of the rule. There are a couple of basic targets,
the ACCEPT and DROP targets, which we
will deal with first. However, before we do that, let us have a brief look at
how a jump is done.
The jump specification is done in exactly the same way as in the target
definition, except that it requires a chain within the same table to jump to.
To jump to a specific chain, it is of course a prerequisite that that chain
exists. As we have already explained, a user-defined chain is created with the
-N command. For example, let's say we create a chain in the
filter table called tcp_packets, like this:
iptables -N tcp_packets
We could then add a jump target to it like this:
iptables -A INPUT -p tcp -j tcp_packets
We would then jump from the INPUT chain to the
tcp_packets chain and start traversing that chain. When/If
we reach the end of that chain, we get dropped back to the
INPUT chain and the packet starts traversing from the rule
one step below where it jumped to the other chain (tcp_packets in this case).
If a packet is ACCEPTed within one of the sub chains, it
will be ACCEPT'ed in the superset chain also and it will
not traverse any of the superset chains any further. However, do note that the
packet will traverse all other chains in the other tables in a normal fashion.
For more information on table and chain traversing, see the Traversing of tables and chains
chapter.
Targets on the other hand specify an action to take on the
packet in question. We could for example, DROP or
ACCEPT the packet depending on what we want to do.
There are also a number of other actions we may want to take, which we
will describe further on in this section. Jumping to targets may incur
different results, as it were. Some targets will cause the packet to stop
traversing that specific chain and superior chains as described above.
Good examples of such rules are DROP and
ACCEPT. Rules that are stopped, will not pass through
any of the rules further on in the chain or in superior chains. Other
targets, may take an action on the packet, after which the packet will
continue passing through the rest of the rules. A good example of this
would be the LOG, ULOG and
TOS targets. These targets can log the
packets, mangle them and then pass them on to the other
rules in the same set of chains. We might, for example, want this so that
we in addition can mangle both the TTL and the
TOS values of a specific packet/stream. Some
targets will accept extra options (What TOS value
to use etc), while others don't necessarily need any options - but we
can include them if we want to (log prefixes, masquerade-to ports and so
on). We will try to cover all of these points as we go through the target
descriptions. Let us have a look at what kinds of targets there are.
This target needs no further options. As soon as the match
specification for a packet has been fully satisfied, and we specify ACCEPT as
the target, the rule is accepted and will not continue traversing the current
chain or any other ones in the same table. Note however, that a packet that
was accepted in one chain might still travel through chains within other
tables, and could still be dropped there. There is nothing special about this
target whatsoever, and it does not require, nor have the possibility of,
adding options to the target. To use this target, we simply specify
-j ACCEPT.
 | Works under Linux kernel 2.3, 2.4, 2.5 and 2.6.
|
