Doubt about iptables rules.

[Vinicius]

Hello,

On the chain RH-Firewall-1-INPUT, what's the mean of the rules number 1
and 2, please?

"# iptables -L --line-number
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    ACCEPT     icmp --  anywhere             anywhere            icmp any
"

TIA,
Vinicius.

[Gawain Lynch]

On Tue, 2006-05-30 at 23:22 -0300, Vinicius wrote:
> Hello,
>
> On the chain RH-Firewall-1-INPUT, what's the mean of the rules number 1
> and 2, please?

[SNIP]
> Chain RH-Firewall-1-INPUT (2 references)
> num  target     prot opt source               destination
> 1    ACCEPT     all  --  anywhere             anywhere
> 2    ACCEPT     icmp --  anywhere             anywhere            icmp any
> "

If you try "iptables -L -v" you will see that number 1 is to allow all
traffic on the loopback adapter (lo)

As for line number 2, this accepts *all* ICMP traffic.  Not ideal, just
the way it is  :-)

[John DeDourek]

Gawain Lynch wrote:
> On Tue, 2006-05-30 at 23:22 -0300, Vinicius wrote:
> > Hello,
> >
> > On the chain RH-Firewall-1-INPUT, what's the mean of the rules number 1
> > and 2, please?
>
> [SNIP]
> > Chain RH-Firewall-1-INPUT (2 references)
> > num  target     prot opt source               destination
> > 1    ACCEPT     all  --  anywhere             anywhere
> > 2    ACCEPT     icmp --  anywhere             anywhere            icmp any
> > "
>
> If you try "iptables -L -v" you will see that number 1 is to allow all
> traffic on the loopback adapter (lo)
>
> As for line number 2, this accepts *all* ICMP traffic.  Not ideal, just
> the way it is  :-)

Yes.  Unfortunately, iptables -L doesn't show the interface, which is
really necessary to understand the rules.  The solution suggested by
the previous poster solves this.

I have concluded some time ago that "-L" without "-v" is useless.
Unfortunately, adding "-v" also produces a very wide listing by
including the individual rule packet counts, which I don't need to
understand the rules.

Obviously, an enhancement might be to add the interface to the
"-L" output itself.  Unfortunately, the output of commands like this
is often processed by other programs and scripts, so changing the
output has to be carefully weighed against the breaking of all
those processing programs.