Join Log in
Score:0
ekzyis avatar Server

iptables uses default policy even though rule matches

ht flag
ekzyis

I am currently trying to learn how iptables works. I have read the following:

When a packet arrives (or leaves, depending on the chain), iptables matches it against rules in these chains one-by-one. When it finds a match, it jumps onto the target and performs the action associated with it. If it doesn’t find a match with any of the rules, it simply does what the default policy of the chain tells it to. The default policy is also a target. 1

I have now set up my INPUT chain on the filter table like this:

$ iptables -S INPUT
-P INPUT ACCEPT
-A INPUT -i wg0 -j ACCEPT

Pinging the machine (10.0.0.1) from another machine (10.0.0.2) using the wg0 interface now works.

Using iptables -S INPUT -v, I can also see that the rule matches since the packet and bytes counters are increasing.

Adding a log target with iptables -I INPUT -i wg0 -j LOG --log-prefix "INPUT-wg0: " further confirms this. I can now see the packets using dmesg -w.

However, when I now set the default policy to DROP, no packets are logged anymore and pinging is no longer possible:

$ iptables -S INPUT
-P INPUT DROP
-A INPUT -i wg0 -j LOG --log-prefix "INPUT-wg0: "
-A INPUT -i wg0 -j ACCEPT

I don't understand this. I thought the target of the first matching rule will be used? (The LOG target seems to be an exception)

The rules matched before and thus should still match even after the default policy was changed, right?

I would be very happy if someone could explain this link's behavior to me.

Output of iptables-save while pinging works:

# Generated by iptables-save v1.8.8 on Fri Dec 23 06:18:42 2022
*mangle
:PREROUTING ACCEPT [31842:2917695]
:INPUT ACCEPT [28740:2664375]
:FORWARD ACCEPT [3102:253320]
:OUTPUT ACCEPT [23607:5802958]
:POSTROUTING ACCEPT [26366:6035482]
COMMIT
# Completed on Fri Dec 23 06:18:42 2022
# Generated by iptables-save v1.8.8 on Fri Dec 23 06:18:42 2022
*raw
:PREROUTING ACCEPT [217327:66651913]
:OUTPUT ACCEPT [102949:46884985]
COMMIT
# Completed on Fri Dec 23 06:18:42 2022
# Generated by iptables-save v1.8.8 on Fri Dec 23 06:18:42 2022
*nat
:PREROUTING ACCEPT [115:6688]
:INPUT ACCEPT [49:2632]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [62:3720]
-A POSTROUTING -s 10.0.0.0/24 -o wg0 -j MASQUERADE
COMMIT
# Completed on Fri Dec 23 06:18:42 2022
# Generated by iptables-save v1.8.8 on Fri Dec 23 06:18:42 2022
*filter
:INPUT ACCEPT [974:119665]
:FORWARD ACCEPT [474:28440]
:OUTPUT ACCEPT [558:81105]
-A INPUT -i wg0 -j ACCEPT
-A FORWARD -i wg0 -o wg0 -j ACCEPT
COMMIT
# Completed on Fri Dec 23 06:18:42 2022

Output of iptables-save after changing default policy of INPUT chain to DROP and pinging no longer works:

# Generated by iptables-save v1.8.8 on Fri Dec 23 06:22:19 2022
*mangle
:PREROUTING ACCEPT [32468:2982249]
:INPUT ACCEPT [29284:2723905]
:FORWARD ACCEPT [3184:258344]
:OUTPUT ACCEPT [23854:5839963]
:POSTROUTING ACCEPT [26695:6077511]
COMMIT
# Completed on Fri Dec 23 06:22:19 2022
# Generated by iptables-save v1.8.8 on Fri Dec 23 06:22:19 2022
*raw
:PREROUTING ACCEPT [217953:66716467]
:OUTPUT ACCEPT [103193:46921614]
COMMIT
# Completed on Fri Dec 23 06:22:19 2022
# Generated by iptables-save v1.8.8 on Fri Dec 23 06:22:19 2022
*nat
:PREROUTING ACCEPT [165:9268]
:INPUT ACCEPT [73:3868]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [71:4260]
-A POSTROUTING -s 10.0.0.0/24 -o wg0 -j MASQUERADE
COMMIT
# Completed on Fri Dec 23 06:22:19 2022
# Generated by iptables-save v1.8.8 on Fri Dec 23 06:22:19 2022
*filter
:INPUT DROP [205:26532]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [26:9060]
-A INPUT -i wg0 -j ACCEPT
-A FORWARD -i wg0 -o wg0 -j ACCEPT
COMMIT
# Completed on Fri Dec 23 06:22:19 2022

(There are some additional rules related to my Wireguard VPN setup here which I didn't mention but they didn't seem to be relevant for my default policy question)

75
2 + 2
us flag
Tero Kilkanen
Please show output of `iptables-save`.
0
Reply
ekzyis avatar
ht flag
ekzyis
Hello, thanks for your reply. I added the output now
0
Reply
Score:0
ekzyis avatar Server
ht flag
ekzyis

As mentioned in a comment to this answer, the solution was to also allow packets on the eth0 interface. This makes sense since the wg0 interface is only virtual and the eth0 interface is required to establish a tunnel.

+ 0
Score:-2
Zareh Kasparian avatar Server
us flag
Zareh Kasparian

The rules are processed in line by line order. so If there is a match for a rule no other rules will be processed for that IP packet. If the rule specifies an ACCEPT target for a matching packet, the packet skips the rest of the rule checks and is allowed to continue to its destination. If a rule specifies a DROP target, that packet is refused access to the system and nothing is sent back to the host that sent the packet.

As you stated, in following rule-set, Drop is mated first and there is no further process to go to next line to log your packets.

iptables -S INPUT
-P INPUT DROP   ***Matched Line***
-A INPUT -i wg0 -j LOG --log-prefix "INPUT-wg0: "
-A INPUT -i wg0 -j ACCEPT

Now if you want to add logging, meanwhile dropping packets, something like this may help you.

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

For more details please refer to the link below. How to Log Linux IPTables Firewall Dropped Packets to a Log File

+ 3
ekzyis avatar
ht flag
ekzyis
Actually, a friend of mine just solved my problem: The wg0 interface does not work without the eth0 interface since it's required to establish the tunnel. So I had to add a rule to accept all packets from eth0 like this: `iptables -I INPUT -i eth0 -j ACCEPT`. That solved my problem. Thanks for the answer though.
1
Reply
Tom Yan avatar
in flag
Tom Yan
`-P` is essentially the last line to process (i.e., when the traffic is matched by no rule).
0
Reply
us flag
Tero Kilkanen
If you find the answer yourself, please write it as an answer and accept it so that others can find it.
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.