How to abbreviate iptables rules?

acgbox

4/4/24, 10:39 PM

I have these example rules from iptables and I want to economize them

lan=enp2s0
iptables -A INPUT -i $lan -p tcp --dport 1234 -j NFLOG --nflog-prefix 'foo'
iptables -A INPUT -i $lan -p tcp --dport 1234 -j ACCEPT
iptables -A FORWARD -i $lan -p tcp --dport 1234 -j NFLOG --nflog-prefix 'foo'
iptables -A FORWARD -i $lan -p tcp --dport 1234 -j ACCEPT
iptables -t mangle -A PREROUTING -i $lan -p tcp --dport 1234 -j NFLOG --nflog-prefix 'foo'
iptables -t mangle -A PREROUTING -i $lan -p tcp --dport 1234 -j ACCEPT

I tried with a custom rule but it doesn't work for me. It says that the chain MYCHAIN already exists

iptables -N MYCHAIN
iptables -A INPUT -i $lan -p tcp --dport 1234 -j MYCHAIN
iptables -A FORWARD -i $lan -p tcp --dport 1234 -j MYCHAIN
iptables -t mangle -A PREROUTING -i $lan -p tcp --dport 1234 -j MYCHAIN
iptables -A MYCHAIN -j NFLOG --nflog-prefix 'foo'
iptables -A MYCHAIN -j ACCEPT

How to abbreviate iptables rules? (to economize lines)

0 + 9

iptables

ubuntu-22.04

Francisco

4/5/24, 12:58 AM

Why you allow packets from your LAN to proxy services in your host (INPUT rule definition), and at same time you try to allow access to 3128 port in any other destination address from LAN (forward rule definition)!?

Francisco

4/5/24, 1:53 AM

One other thing, is ip_forwarding enabled on your OS?

A.B

4/5/24, 6:19 AM

a chain's namespace is its table. so MYCHAIN has to be defined twice. nftables (where the table concept differs a bit) allows to put all chains in the same table thus reusing the same chain (and has also other methods to simplify rules, like being able to merge the two iptables rules in a single rule without additional chain, among other ways). Also you state "MYCHAIN already exists" while the expected error is "Chain 'MYCHAIN' does not exist" for the 4th line.

acgbox

4/5/24, 1:00 PM

@Francisco Thanks for participating. The object of the question is not what the rules do. They are sample rules. It may be other rules. The object of the question is how to economize rules

acgbox

4/5/24, 1:03 PM

@A.B you could post your full answer with the proposed correction. Thank you

A.B

4/5/24, 1:23 PM

So you're fine with nftables instead of iptables? Ok I'll do an answer with this (in a few hours when I get time for this).

acgbox

4/5/24, 2:07 PM

@A.B The question is about iptables. I would prefer an answer with iptables. I'm not familiar with nftables. Thanks anyway

A.B

4/5/24, 3:50 PM

Ok. I don't have any answer then.

Ginnungagap

4/6/24, 9:28 PM

Trying to optimize iptables is pointless, on most modern distros it gets converted to nftables anyway. Just switch to nftables. @A.B, in the spirit of the site, I'd suggest posting an nftables answer anyway since it would be the better answer given the constraints of the question which has no justification for using deprecated solutions.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to abbreviate iptables rules?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.