<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:brian@pondconsulting.net" title="Brian Pond <brian@pondconsulting.net>"> <span class="fn">Brian Pond</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305">bug 1305</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>brian@pondconsulting.net
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305">bug 1305</a>
from <span class="vcard"><a class="email" href="mailto:brian@pondconsulting.net" title="Brian Pond <brian@pondconsulting.net>"> <span class="fn">Brian Pond</span></a>
</span></b>
<pre>Comment on <span class=""><a href="attachment.cgi?id=602" name="attach_602" title="Script demonstrating conflicting base chains.">attachment 602</a> <a href="attachment.cgi?id=602&action=edit" title="Script demonstrating conflicting base chains.">[details]</a></span>
Script demonstrating conflicting base chains.
I am unsure whether this is a "bug" or "working as intended". But I have
encountered a similar situation as the OP.
Script attached showing how to duplicate. There are 2 base chains for
filter+output.
* The first chain allows outbound HTTP/HTTPS.
* The second chain has a default policy of "drop".
If you apply these rules, you cannot access the web through your browser.
>From a certain point of view, this seems to contradict documentation.
Documentation says that "accept" is a terminating statement. The first chain
is lower priority, so should be evaluated first. Once the outbound HTTP/HTTPS
is accepted, it should not be re-evaluated by the 2nd chain, and dropped.
What I "think" the documentation should say is this:
1) "If you create 2+ base chains for the same hook, all chains are evaluated."
2) "Accept is a terminating statement, but only within its own base chain."
3) "Drop is a terminating statement globally. It will override decisions by
other base chains of the same hook."
Whether this is what the maintainers intended or not, I don't know.
My workaround was creating non-base chains, and doing jumps. I'm kind of
disappointed about that. I'd hoped to avoid jumps altogether, by creating
multiple base chains of different priorities. With my final base chain being
"log drop". This way, if traffic is not explicitly allowed, it is logged and
dropped.
My ruleset is working fine now, but it's not quite-as-clean as I'd hoped.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>