Re: [iptables] Zone based rules

Jimmy Thrasibule <[email protected]> Tue, 09 Apr 2013 23:45:41 +0200

Newsgroups	gmane.linux.debian.devel.firewall
Message-ID	<1365543941.14410.3.camel@draco>

> Have you considered using RETURN instead of ACCEPT ?
> Something like:
> 
>    # Traffic coming from the zones.
>    -A FORWARD -i eth0 ZONE_MRKT_OUT
>    -A FORWARD -i eth1 ZONE_SRV_OUT
> 
>    # Traffic to the zones.
>    -A FORWARD -o eth0 ZONE_MRKT_IN
>    -A FORWARD -o eth1 ZONE_SRV_IN
> 
>    -A FORWARD -j ACCEPT
> 
>    # Let's look at marketing.
>    -A ZONE_MKRT_OUT -j RETURN
>    -A ZONE_MKRT_OUT -j DROP # catch-all, useless here
> 
>    # Servers
>    -A ZONE_SRV_IN -s mar.ket.ing.net/mask -p tcp --dport 22 -j DROP
>    -A ZONE_SRV_IN -j DROP # catch-all
> 
Indeed using RETURN here can do the trick.

--
Jimmy

signature.asc (application/pgp-signature, 836 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAABAgAGBQJRZIwGAAoJEFNYtCSAPHIViJkP/j0dokJiZQjImI0wWwpnKPKf
DHxiNiJCNygsmfcWcyQAFhzXjkMKrQHPBr2FYrrxdmT1PJbOFvEbFjnKIUvamrfF
Sd+Cke5mn5LjzIb0QPNZkdw5/CxZid3zPJbd3jvJQ9XiNV/aQappZ088SQTatVpj
t7P0DU6zM6it/LMk9eLrrD68+1yZPbHS2i3YnnxMlwFSUOMUqs2j+KvsNIAldiW6
8xURyXl2CzlRHMCINO3pWxBe7FvU8DGPcRxJ9+yEU+ZJnxpz0GrjLipDCER9kWdf
zCNB5JT8n/PX7MzKrT/eNQWiQTOeJSaEIQJntKMTt3yq+zSGeQGYPWJR2gnKSyF5
HlGosUcpHsvvLEmWCNIn6ql4TcoQJ9Rbygr4QCRHfZw3ArTzb7vFAW4jbcaGQn1N
P2qvXjaOiOS+p18lHdkBXaffseCUHcgXNtqAZo6XcwVgSdYWN2dKv+on2sz08C/+
bQloa2fesWOqh/3kNl41b/4AUMjxh37F17EQy/2Ag0u+XvHZK07wAdPI9wcDv7v+
RoV5t1uPO7wj/sni18ZU7RVZAQlvd8smwlUPiHx2+aWM5a3LDM99YwihDIJsHqrq
gXdd6LPv3eWNsM7JG5+2FGHbJBjbhwWcADIvkCglTolML5Fn9DiJm4J5iLHYMXwb
rcvIzERtZYDKJM9a8+Mc
=7QIH
-----END PGP SIGNATURE-----