On Monday 12 April 2010 13:31:09 Tanstaafl wrote: > On 2010-04-11 9:20 AM, Graham Murray wrote: > > Tanstaafl <tansta...@libertytrek.org> writes: > >> I'm a bit clueless when it comes to firewalls, and have no idea what > >> these numbers mean/do: > >> > >> *raw > >> > >> :PREROUTING ACCEPT [4911:886011] > >> :OUTPUT ACCEPT [4546:2818732] > >> > >> COMMIT > > > > The numbers are [packets:bytes] which match the rule or table > > concerned. > > Ok, so... I still don't know what they *mean*... ie, is this a hole in > my firewall? What is the raw table used for, in plain english?
I think the man page explains this in plain enough English: "raw: This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes)" So, as long as packets come and go you should see their count increase. > More importantly though... > > When I try to remove the nat and raw tables from my firewall, they don't > go away. I have always kept my rules in a separate file, and when I want > to make changes, I change the external file, then do iptables-restore < > /path/to/iptables-current. > > (My rule set is very small, so this only takes a second or two, so its > not/never been a problem) > > I've been doing it this way for a long time, and all other changes I > have ever made - eg, opening a certain port for a certain host - work > fine, but, when I comment out the raw and nat tables, then restore the > rules, then do iptables-save > path/to/iptables-current-dump, the > examined file still shows the raw and nat tables loaded... ??? You need to read the man pages, but in short if you have certain modules enabled in your kernel you will end up loading certain default tables. I don't know how you have configured your kernel or your firewall (and I am no expert to offer detailed advice) but I am guessing that although you remove a rule or two you are not removing the modules that load these tables. HTH. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
