As I mentioned in “iptables Tips and Tricks – Port Redirection,” iptables is probably a complete mystery to a lot of users, and one the biggest hurdles is understanding the method by which it filters traffic … Once you understand this, you’ll be able to tame the beast.
When I think of iptables, the best analogy that comes to mind is a gravity coin sorting bank with four rules and one policy. If you’re not familiar with a gravity coin sorting bank, each coin is starts at the same place and slides down an declined plane until it can fall into it’s appropriate tube:
As you can see, once a coin starts down the path, there are four rules – each one “filtering traffic” based on the width of the coin in millimeters (Quarter = 25mm, Nickel = 22mm, Penny = 20mm, Dime = 18mm). Due to possible inconsistencies in the coins, the tube widths are slightly larger than the official sizes of each coin to prevent jamming. At the end of the line, if a coin didn’t fit in any of the tubes, it’s dropped out of the sorter.
As we use this visualization to apply to iptables, there are three important things to remember:
- The rules start at the top, and proceed down, one by one unless otherwise directed.
- A rule must match exactly.
- Once iptables has accepted, rejected, or dropped a packet, it will not process any further rules on it.
Let’s jump back to the coin sorter. What would happen if you introduced a 23mm coin (slightly larger than a nickel)? What would happen if you introduced a 17mm coin (smaller than a dime)? What would happen if you dropped in a $1 coin @ 26.5mm?
In the first scenario, the coin would enter into the rule processing by being dropped in at the top. It would first pass by the dime slot, which requires a diameter of less than 18mm. It passes by the pennies slot as well, which requires less than 20mm. It continues past the nickels slot, which requires 22mm or less. It will then be “accepted” into the quarters slot, and there will be no further “processing” on the coin.
The iptables rules might look something like this:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all --- 0.0.0.0/0 0.0.0.0/0 width<18.0mm
ACCEPT all --- 0.0.0.0/0 0.0.0.0/0 width<20.0mm
ACCEPT all --- 0.0.0.0/0 0.0.0.0/0 width<22.0mm
ACCEPT all --- 0.0.0.0/0 0.0.0.0/0 width<25.0mm
It's important to remember that once iptables has accepted, rejected, or dropped a packet, it will not process any further rules on it. In the second scenario (17mm coin), the coin would only be processed through the first rule; the other 3 rules would not be used even though the coin would meet their rules as well. Just because a port or and IP address is allowed somewhere in a chain, if a matching rule has dropped the packet, no further rules will be processed.
The final scenario (26.5mm coin) outlines a situation where none of the rules match, and this indicates that the policy will be used. In the coin bank example, it would be physically dropped off the side of the bank. iptables keeps a tally of the number of packets dropped and the corresponding size of the data. You can view this data by using the "iptables -vnL" command.
Chain OUTPUT (policy ACCEPT 3418K packets, 380M bytes)
cPanel even uses this tally functionality to track bandwidth usage (You may have seen the "acctboth" chain - this is used for tracking usage per IP).
So there you have it: iptables is just like a gravity coin sorting bank!
-Mark