>> On Thu, Sep 26, 2013 at 11:41 AM, Fred Maillou <[email protected]> wrote:
>> In masquerading, which one gets processed first, a firewall
>> rule, or the masquerading ? I'd think masquerading gets >
>> processed first, but I'm not certain.
> De : Guilsson G <[email protected]>
> As Shorewall, in fact, configure Netfilter/Iptables best way is
> to look how packets traverses Linux's Kernel.
> Look this:
> http://www.adminsehow.com/2011/09/iptables-packet-traverse-map/
According to the last diagram on that page, it would mean that
incoming packets from the network would be NAT-processed first,
then processed through the firewall rules.
Whereas packets generated by the firewall device would be
processed by rules first and then NAT'ed.
In the case of a router, all packets going through it would be
processed by NAT first, then FW rules would be applied.
I guess this makes sense, but am not sure yet. The first diagram
on that page has a logic error in which two of the 'routing
decision' boxes have no alternative route. If a decision was
taken, then there should be at least a case of yes/no. As it is
in the third 'routing decision' box.
Fred.
________________________________
De : Guilsson G <[email protected]>
À : Fred Maillou <[email protected]>; Shorewall Users
<[email protected]>
Envoyé le : jeudi 26 Septembre 2013 11h02
Objet : Re: [Shorewall-users] Processing precedence: rule/MASQ
As Shorewall, in fact, configure Netfilter/Iptables best way is to look how
packets traverses Linux's Kernel.
Look this: http://www.adminsehow.com/2011/09/iptables-packet-traverse-map/
On Thu, Sep 26, 2013 at 11:41 AM, Fred Maillou <[email protected]> wrote:
Hi,
>
>
> In masquerading, which one gets processed first, a firewall rule, or the
>masquerading ? I'd think masquerading gets processed first, but I'm not
>certain.
>
>
>Thanks !
>
>
>------------------------------------------------------------------------------
>October Webinars: Code for Performance
>Free Intel webinars can help you accelerate application performance.
>Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
>the latest Intel processors and coprocessors. See abstracts and register >
>http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
>_______________________________________________
>Shorewall-users mailing list
>[email protected]
>https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
>
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
