<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - negated rule and rule with mistyped interface name looks identical in non-verbose iptables output"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1166">1166</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>negated rule and rule with mistyped interface name looks identical in non-verbose iptables output
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>suawekk@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Here's the thing:
I was adding rule for masquerading packets from VM bridge, and I wanted to add
rule that applies masquerade for packages leaving laptop with VMs on all
interfaces excluding one (vm bridge) because why not.
And I made little typo
Instead of
iptables -t nat -A POSTROUTING -s 10.118.196.0/24 \! -o lxdbr0 -j MASQUERADE
I typed:
iptables -vv -t nat -A POSTROUTING -s 10.118.196.0/24 -o \! lxdbr0 -j
MASQUERADE
I noticed that rule wasn't matching so after a while I noticed what was the
problem.
But funny thing is:
both rules when displaying them with `iptables -t nat -nvL` are shown as
follows:
0 0 MASQUERADE all -- * !lxdbr0 10.118.196.0/24 0.0.0.0/0
6 628 MASQUERADE all -- * !lxdbr0 10.118.196.0/24 0.0.0.0/0
You can see that first rule (one with mistake) is displayed identically but
doesn't match.
Displaying rules with more verbosity (iptables -nvvL) show that first rule
tries to match packets going
through interface with literal name `!lxdbr0` while second rule matches packets
going through `lxdbr0` but
with inversion flag set to `02`
I'm not sure whether it's expected so I wrote this report so you can decide
whether it's bug or feature ;)
System info:
OS: archlinux latest
iptables v.1.6.1
kernel: 4.12.3-1-ARCH</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>