Download "87%" class="v1"

1
[ Team LiB ]
Recipe 2.22 Building Complex Rule Trees
2.22.1 Problem
You want to construct complex firewall behaviors, but you are getting lost in the complexity.
2.22.2 Solution
Be modular: isolate behaviors into their own chains. Then connect the chains in the desired manner.
For iptables:
"docText">Add your rules to each chain. Then connect the chains; for example:
#
#
#
#
#
iptables
iptables
iptables
iptables
iptables
-A
-A
-A
-A
-A
INPUT ...specification... -j CHAIN1
CHAIN1 ...specification... -j CHAIN2
CHAIN2 ...specification... -j CHAIN3
INPUT ...specification... -j CHAIN4
INPUT ...specification... -j CHAIN5
to create a rule structure as in Figure 2-1.
Figure 2-1. Building rule chain structures in iptables or ipchains
For ipchains:
#
#
#
#
#
ipchains
ipchains
ipchains
ipchains
ipchains
-N
-N
-N
-N
-N
chain1
chain2
chain3
chain4
chain5
Add your rules to each chain. Then connect the chains, for example:
#
#
#
#
#
ipchains
ipchains
ipchains
ipchains
ipchains
-A
-A
-A
-A
-A
input ...specification... -j chain1
chain1 ...specification... -j chain2
chain2 ...specification... -j chain3
input ...specification... -j chain4
input ...specification... -j chain5
to create the same rule structure as in Figure 2-1.
1