Iptables :: priority of rules

[Res]

On Fri, 23 Feb 2007, Luc MAIGNAN wrote:

> Sorry for the information I've forgotten to give to you. I've set the INPUT 
> policy to DROP
>
> BR

so your accepts should work, no need to use any -j DROP if policy is DROP
its first come first served in matching, so it should find your internal 
IP's somewhere in its order and let you in, if it doesnt you have a bigger 
problem.



>
>
> Res a écrit :
>> On Fri, 23 Feb 2007, Luc MAIGNAN wrote:
>> 
>>> In fact, isn't what I wrote ?
>>> 
>> 
>> No, I believe Tim meant a default drop "policy" then the rules you add are 
>> accepts.
>> 
>> eg:
>> iptables -P INPUT DROP
>> iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
>> iptables -A INPUT -s special.ip.allowed -j ACCEPT
>> 
>> 
>>> 
>>> 
>>> 
>>> Tim a écrit :
>>>> On Fri, 2007-02-23 at 11:26 +0100, Luc MAIGNAN wrote:
>>>> 
>>>>> I don't understand how the priority of the rules of iptables is set.
>>>>> 
>>>>> My problem : I want to allow ssh from my local network(1), and from 
>>>>> outside only for an IP(2)
>>>>> 
>>>>> So i Wrote :
>>>>> 
>>>>> (1) : iptables -I INPUT -p tcp -s 192.168.0.0/24 --dport ssh -j ACCEPT
>>>>> (2) : iptables -I INPUT -p tcp -s ! x.x.x.x --dport ssh -j DROP
>>>>> 
>>>>> The result is that I can ssh only from the ousided IP, not from local 
>>>>> network. If I switch the two rules, the result is the same.
>>>>> 
>>>>> Can anyone help me to understand ?
>>>>> 
>>>> 
>>>> You can have a default drop rule on all input traffic, then add a couple
>>>> of specific rules to allow it from your local network, and another to
>>>> allow it from a specific address.
>>>> 
>>>> 
>>> 
>>> 
>> 
>
>

-- 
Cheers
Res

"We can be Heroes, just for one day" - Davey (Jones) Bowie